Home | History | Annotate | Download | only in adapters
      1 /*
      2  * CDDL HEADER START
      3  *
      4  * The contents of this file are subject to the terms of the
      5  * Common Development and Distribution License (the "License").
      6  * You may not use this file except in compliance with the License.
      7  *
      8  * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
      9  * or http://www.opensolaris.org/os/licensing.
     10  * See the License for the specific language governing permissions
     11  * and limitations under the License.
     12  *
     13  * When distributing Covered Code, include this CDDL HEADER in each
     14  * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
     15  * If applicable, add the following below this CDDL HEADER, with the
     16  * fields enclosed by brackets "[]" replaced with your own identifying
     17  * information: Portions Copyright [yyyy] [name of copyright owner]
     18  *
     19  * CDDL HEADER END
     20  */
     21 /*
     22  * Copyright 2008 Sun Microsystems, Inc.  All rights reserved.
     23  * Use is subject to license terms.
     24  */
     25 
     26 
     27 /*
     28  * esp - Emulex SCSI Processor host adapter driver with FAS101/236,
     29  *	tagged and non-tagged queuing support
     30  */
     31 #if defined(lint) && !defined(DEBUG)
     32 #define	DEBUG	1
     33 #define	ESP_CHECK
     34 #endif
     35 
     36 #include <sys/note.h>
     37 
     38 #include <sys/modctl.h>
     39 #include <sys/scsi/scsi.h>
     40 
     41 /*
     42  * these are non-ddi compliant:
     43  */
     44 #include <sys/varargs.h>
     45 #include <sys/var.h>
     46 #include <sys/proc.h>
     47 #include <sys/thread.h>
     48 #include <sys/utsname.h>
     49 #include <sys/kstat.h>
     50 #include <sys/vtrace.h>
     51 #include <sys/kmem.h>
     52 #include <sys/callb.h>
     53 
     54 /*
     55  * private
     56  */
     57 #include <sys/scsi/adapters/espvar.h>
     58 #include <sys/scsi/adapters/espcmd.h>
     59 #include <sys/scsi/impl/scsi_reset_notify.h>
     60 
     61 /*
     62  * External references
     63  */
     64 extern uchar_t	scsi_cdb_size[];
     65 
     66 /*
     67  * tunables
     68  */
     69 static int esp_burst_sizes_limit = 0xff; /* patch in case of hw problems */
     70 static int esp_selection_timeout = 250; /* 250 milliseconds */
     71 
     72 #ifdef ESP_KSTATS
     73 static int esp_do_kstats = 1;
     74 static int esp_do_bus_kstats = 1;
     75 #endif
     76 
     77 #ifdef	ESPDEBUG
     78 static int espdebug = 0;
     79 static int esp_no_sync_backoff = 0;
     80 static void esp_stat_int_print(struct esp *esp);
     81 static int esp_test_stop;
     82 #endif	/* ESPDEBUG */
     83 
     84 /*
     85  * Local static data
     86  * the global mutex protects some of these esp driver variables
     87  */
     88 static kmutex_t esp_global_mutex;
     89 static int esp_watchdog_running = 0;
     90 static int esp_scsi_watchdog_tick;	/* in sec */
     91 static clock_t esp_tick;		/* esp_watch() interval in Hz */
     92 static timeout_id_t esp_reset_watch;
     93 static timeout_id_t esp_timeout_id = 0;
     94 static int esp_timeout_initted = 0;
     95 static int esp_n_esps = 0;
     96 static void *esp_state;
     97 static kmutex_t esp_log_mutex;
     98 static char esp_log_buf[256];
     99 
    100 /*
    101  * readers/writer lock to protect the integrity of the softc structure
    102  * linked list while being traversed (or updated).
    103  */
    104 static krwlock_t esp_global_rwlock;
    105 static struct esp *esp_softc = (struct esp *)0;
    106 static struct esp *esp_tail;
    107 
    108 /*
    109  * variables & prototypes for torture testing
    110  */
    111 #ifdef ESP_TEST_RQSENSE
    112 static int esp_test_rqsense;
    113 #endif /* ESP_TEST_RQSENSE */
    114 
    115 #ifdef	ESP_TEST_PARITY
    116 static int esp_ptest_emsgin;
    117 static int esp_ptest_msgin;
    118 static int esp_ptest_msg = -1;
    119 static int esp_ptest_status;
    120 static int esp_ptest_data_in;
    121 #endif	/* ESP_TEST_PARITY */
    122 
    123 #ifdef ESP_TEST_ABORT
    124 static int esp_atest;
    125 static int esp_atest_disc;
    126 static int esp_atest_reconn;
    127 static void esp_test_abort(struct esp *esp, int slot);
    128 #endif /* ESP_TEST_ABORT */
    129 
    130 #ifdef ESP_TEST_RESET
    131 static int esp_rtest;
    132 static int esp_rtest_type;
    133 static void esp_test_reset(struct esp *esp, int slot);
    134 #endif /* ESP_TEST_RESET */
    135 
    136 #ifdef ESP_TEST_TIMEOUT
    137 static int esp_force_timeout;
    138 #endif /* ESP_TEST_TIMEOUT */
    139 
    140 #ifdef ESP_TEST_BUS_RESET
    141 static int esp_btest;
    142 #endif /* ESP_TEST_BUS_RESET */
    143 
    144 #ifdef ESP_TEST_UNTAGGED
    145 static int esp_test_untagged;
    146 static int esp_enable_untagged;
    147 static int esp_test_stop;
    148 #endif /* ESP_TEST_UNTAGGED */
    149 #ifdef ESP_PERF
    150 _NOTE(SCHEME_PROTECTS_DATA("Stable Data", esp_request_count))
    151 _NOTE(SCHEME_PROTECTS_DATA("Stable Data", esp_sample_time))
    152 _NOTE(SCHEME_PROTECTS_DATA("Stable Data", esp_intr_count))
    153 _NOTE(SCHEME_PROTECTS_DATA("Stable Data", esp_ncmds))
    154 _NOTE(SCHEME_PROTECTS_DATA("Stable Data", esp_ndisc))
    155 _NOTE(SCHEME_PROTECTS_DATA("Stable Data", esp_ncmds_per_esp))
    156 
    157 /*
    158  * these should really be protected but it is not really important
    159  * to be very accurate
    160  */
    161 static int esp_request_count;
    162 static int esp_sample_time = 0;
    163 static int esp_intr_count;
    164 static int esp_ncmds;
    165 static int esp_ndisc;
    166 #define	MAX_ESPS	80	/* should be enough */
    167 static int esp_ncmds_per_esp[MAX_ESPS];
    168 #endif
    169 
    170 _NOTE(SCHEME_PROTECTS_DATA("unique per pkt", \
    171 	scsi_pkt esp_cmd buf scsi_cdb scsi_status))
    172 _NOTE(SCHEME_PROTECTS_DATA("stable data", scsi_address scsi_device))
    173 _NOTE(SCHEME_PROTECTS_DATA("No Mutex Needed", esp_watchdog_running))
    174 _NOTE(DATA_READABLE_WITHOUT_LOCK(esp_scsi_watchdog_tick))
    175 _NOTE(DATA_READABLE_WITHOUT_LOCK(espdebug))
    176 _NOTE(DATA_READABLE_WITHOUT_LOCK(dmaga))
    177 
    178 /*
    179  * function prototypes
    180  *
    181  * scsa functions are exported by means of the transport table
    182  */
    183 static int esp_scsi_tgt_probe(struct scsi_device *sd,
    184     int (*waitfunc)(void));
    185 static int esp_scsi_tgt_init(dev_info_t *, dev_info_t *,
    186     scsi_hba_tran_t *, struct scsi_device *);
    187 static int esp_start(struct scsi_address *ap, struct scsi_pkt *pkt);
    188 static int esp_abort(struct scsi_address *ap, struct scsi_pkt *pkt);
    189 static int esp_reset(struct scsi_address *ap, int level);
    190 static int esp_commoncap(struct scsi_address *ap, char *cap, int val,
    191     int tgtonly, int doset);
    192 static int esp_getcap(struct scsi_address *ap, char *cap, int whom);
    193 static int esp_setcap(struct scsi_address *ap, char *cap, int value, int whom);
    194 static struct scsi_pkt *esp_scsi_init_pkt(struct scsi_address *ap,
    195     struct scsi_pkt *pkt, struct buf *bp, int cmdlen, int statuslen,
    196     int tgtlen, int flags, int (*callback)(), caddr_t arg);
    197 static void esp_scsi_destroy_pkt(struct scsi_address *ap, struct scsi_pkt *pkt);
    198 static void esp_scsi_dmafree(struct scsi_address *ap,
    199     struct scsi_pkt *pkt);
    200 static void esp_scsi_sync_pkt(struct scsi_address *ap,
    201     struct scsi_pkt *pkt);
    202 
    203 /*
    204  * internal functions
    205  */
    206 static int esp_ustart(struct esp *esp, short start_slot, short flag);
    207 static int esp_startcmd(struct esp *esp, struct esp_cmd *sp);
    208 static int esp_finish(struct esp *esp);
    209 static void esp_handle_qfull(struct esp *esp, struct esp_cmd *sp, int slot);
    210 static void esp_restart_cmd(void *);
    211 static int esp_dopoll(struct esp *esp, int timeout);
    212 static uint_t esp_intr(caddr_t arg);
    213 static void espsvc(struct esp *esp);
    214 static int esp_phasemanage(struct esp *esp);
    215 static int esp_handle_unknown(struct esp *esp);
    216 static int esp_handle_cmd_start(struct esp *esp);
    217 static int esp_handle_cmd_done(struct esp *esp);
    218 static int esp_handle_msg_out(struct esp *esp);
    219 static int esp_handle_msg_out_done(struct esp *esp);
    220 static int esp_handle_clearing(struct esp *esp);
    221 static int esp_handle_data(struct esp *esp);
    222 static int esp_handle_data_done(struct esp *esp);
    223 static int esp_handle_c_cmplt(struct esp *esp);
    224 static int esp_handle_msg_in(struct esp *esp);
    225 static int esp_handle_more_msgin(struct esp *esp);
    226 static int esp_handle_msg_in_done(struct esp *esp);
    227 static int esp_onebyte_msg(struct esp *esp);
    228 static int esp_twobyte_msg(struct esp *esp);
    229 static int esp_multibyte_msg(struct esp *esp);
    230 static int esp_finish_select(struct esp *esp);
    231 static int esp_reconnect(struct esp *esp);
    232 static int esp_istart(struct esp *esp);
    233 static void esp_runpoll(struct esp *esp, short slot, struct esp_cmd *sp);
    234 static int esp_reset_bus(struct esp *esp);
    235 static int esp_reset_recovery(struct esp *esp);
    236 static int esp_handle_selection(struct esp *esp);
    237 static void esp_makeproxy_cmd(struct esp_cmd *sp,
    238     struct scsi_address *ap, int nmsg, ...);
    239 static void esp_make_sdtr(struct esp *esp, int msgout_offset,
    240     int period, int offset);
    241 static void esp_watch(void *);
    242 static void esp_watchsubr(struct esp *esp);
    243 static void esp_cmd_timeout(struct esp *esp, struct esp_cmd *sp, int slot);
    244 static int esp_abort_curcmd(struct esp *esp);
    245 static int esp_abort_cmd(struct esp *esp, struct esp_cmd *sp, int slot);
    246 static int esp_abort_allcmds(struct esp *esp);
    247 static void esp_internal_reset(struct esp *esp, int reset_action);
    248 static void esp_sync_backoff(struct esp *esp, struct esp_cmd *sp, int slot);
    249 static void esp_hw_reset(struct esp *esp, int action);
    250 /*PRINTFLIKE3*/
    251 static void esplog(struct esp *esp, int level, const char *fmt, ...)
    252 	__KPRINTFLIKE(3);
    253 /*PRINTFLIKE2*/
    254 static void eprintf(struct esp *esp, const char *fmt, ...)
    255 	__KPRINTFLIKE(2);
    256 static void esp_printstate(struct esp *esp, char *msg);
    257 static void esp_dump_cmd(struct esp_cmd *sp);
    258 static void esp_dump_state(struct esp *esp);
    259 static char *esp_state_name(ushort_t state);
    260 static void esp_update_props(struct esp *esp, int tgt);
    261 static int _esp_start(struct esp *esp, struct esp_cmd *sp, int flag);
    262 static int _esp_abort(struct scsi_address *ap, struct scsi_pkt *pkt);
    263 static int _esp_reset(struct scsi_address *ap, int level);
    264 static int esp_alloc_tag(struct esp *esp, struct esp_cmd *sp);
    265 static int esp_remove_readyQ(struct esp *esp, struct esp_cmd *sp, int slot);
    266 static void esp_flush_readyQ(struct esp *esp, int slot);
    267 static void esp_flush_tagQ(struct esp *esp, int slot);
    268 static void esp_flush_cmd(struct esp *esp, struct esp_cmd *sp,
    269     uchar_t reason, uint_t stat);
    270 static int esp_abort_connected_cmd(struct esp *esp, struct esp_cmd *sp,
    271     uchar_t msg);
    272 static int esp_abort_disconnected_cmd(struct esp *esp, struct scsi_address *ap,
    273     struct esp_cmd *sp, uchar_t msg, int slot);
    274 static void esp_mark_packets(struct esp *esp, int slot, uchar_t reason,
    275     uint_t stat);
    276 static int esp_reset_connected_cmd(struct esp *esp, struct scsi_address *ap,
    277     int slot);
    278 static int esp_reset_disconnected_cmd(struct esp *esp, struct scsi_address *ap,
    279     int slot);
    280 static int esp_create_arq_pkt(struct esp *esp, struct scsi_address *ap,
    281     int size);
    282 static int esp_start_arq_pkt(struct esp *esp, struct esp_cmd *sp);
    283 static void esp_complete_arq_pkt(struct esp *esp, struct esp_cmd *sp,
    284     int slot);
    285 static void esp_determine_chip_type(struct esp *esp);
    286 static void esp_create_callback_thread(struct esp *esp);
    287 static void esp_destroy_callback_thread(struct esp *);
    288 static void esp_callback(struct esp *esp);
    289 static void esp_call_pkt_comp(struct esp *esp, struct esp_cmd *sp);
    290 static int esp_set_new_window(struct esp *esp, struct esp_cmd *sp);
    291 static int esp_restore_pointers(struct esp *esp, struct esp_cmd *sp);
    292 static int esp_next_window(struct esp *esp, struct esp_cmd *sp);
    293 static void esp_start_watch_reset_delay(struct esp *);
    294 static void esp_watch_reset_delay(void *arg);
    295 static int esp_watch_reset_delay_subr(struct esp *esp);
    296 void esp_wakeup_callback_thread(struct callback_info *cb_info);
    297 static void esp_update_TQ_props(struct esp *esp, int tgt, int value);
    298 static int esp_check_dma_error(struct esp *esp);
    299 static void esp_reset_cleanup(struct esp *esp, int slot);
    300 static int esp_scsi_reset_notify(struct scsi_address *ap, int flag,
    301     void (*callback)(caddr_t), caddr_t arg);
    302 static void esp_set_throttles(struct esp *esp, int slot,
    303     int n, int what);
    304 static void esp_set_all_lun_throttles(struct esp *esp, int slot, int what);
    305 static void esp_save_throttles(struct esp *esp, int slot, int n,
    306     short *throttle);
    307 static void esp_restore_throttles(struct esp *esp, int slot, int n,
    308     short *throttle);
    309 static int esp_do_proxy_cmd(struct esp *esp, struct esp_cmd *sp,
    310     struct scsi_address *ap, int slot, char *what);
    311 static void esp_remove_tagged_cmd(struct esp *esp, struct esp_cmd *sp,
    312     int slot, int timeout);
    313 static void esp_decrement_ncmds(struct esp *esp, struct esp_cmd *sp);
    314 static int esp_pkt_alloc_extern(struct esp *esp, struct esp_cmd *sp,
    315     int cmdlen, int tgtlen, int statuslen, int kf);
    316 static void esp_pkt_destroy_extern(struct esp *esp, struct esp_cmd *sp);
    317 static int esp_kmem_cache_constructor(void *buf, void *cdrarg, int kmflags);
    318 static void esp_kmem_cache_destructor(void *buf, void *cdrarg);
    319 
    320 static void esp_flush_fifo(struct esp *esp);
    321 static void esp_empty_startQ(struct esp *esp);
    322 
    323 #ifdef ESP_CHECK
    324 static void esp_check_in_transport(struct esp *esp, struct esp_cmd *sp);
    325 #else
    326 #define	esp_check_in_transport(esp, sp)
    327 #endif
    328 
    329 /*
    330  * esp DMA attr for all supported dma engines:
    331  */
    332 static ddi_dma_attr_t dma1_espattr = {
    333 	DMA_ATTR_V0, (unsigned long long)0,
    334 	(unsigned long long)0xffffffff, (unsigned long long)((1<<24)-1),
    335 	1, DEFAULT_BURSTSIZE, 1,
    336 	(unsigned long long)0xffffffff, (unsigned long long)((1<<24)-1),
    337 	1, 512, 0
    338 };
    339 
    340 /*
    341  * ESC1 esp dma attr
    342  */
    343 static ddi_dma_attr_t esc1_espattr = {
    344 	DMA_ATTR_V0, (unsigned long long)0,
    345 	(unsigned long long)0xffffffff, (unsigned long long)((1<<24)-1),
    346 	1, DEFAULT_BURSTSIZE | BURST32, 4,
    347 	(unsigned long long)0xffffffff, (unsigned long long)((1<<24)-1),
    348 	1, 512, 0
    349 };
    350 
    351 /*
    352  * DMA2 esp dma attr
    353  */
    354 static ddi_dma_attr_t dma2_espattr = {
    355 	DMA_ATTR_V0, (unsigned long long)0,
    356 	(unsigned long long)0xffffffff, (unsigned long long)((1<<24)-1),
    357 	1, DEFAULT_BURSTSIZE, 1,
    358 	(unsigned long long)0xffffffff, (unsigned long long)((1<<24)-1),
    359 	1, 512, 0
    360 };
    361 
    362 /*
    363  * DMA3 esp dma attr
    364  */
    365 static ddi_dma_attr_t dma3_espattr = {
    366 	DMA_ATTR_V0, (unsigned long long)0x0,
    367 	(unsigned long long)0xffffffff, (unsigned long long)((1<<24)-1),
    368 	1, DEFAULT_BURSTSIZE | BURST32, 1,
    369 	(unsigned long long)0xffffffff, (unsigned long long)((1<<24)-1),
    370 	1, 512, 0
    371 };
    372 
    373 /*
    374  * autoconfiguration routines.
    375  */
    376 static int esp_attach(dev_info_t *dev, ddi_attach_cmd_t cmd);
    377 static int esp_detach(dev_info_t *dev, ddi_detach_cmd_t cmd);
    378 static int esp_dr_detach(dev_info_t *dev);
    379 
    380 static struct dev_ops esp_ops = {
    381 	DEVO_REV,		/* devo_rev, */
    382 	0,			/* refcnt  */
    383 	ddi_no_info,		/* info */
    384 	nulldev,		/* identify */
    385 	nulldev,		/* probe */
    386 	esp_attach,		/* attach */
    387 	esp_detach,		/* detach */
    388 	nodev,			/* reset */
    389 	NULL,			/* cb ops */
    390 	NULL,			/* bus operations */
    391 	ddi_power,		/* power */
    392 	ddi_quiesce_not_supported,	/* devo_quiesce */
    393 };
    394 
    395 char _depends_on[] = "misc/scsi";
    396 
    397 static struct modldrv modldrv = {
    398 	&mod_driverops, /* Type of module. This one is a driver */
    399 	"ESP SCSI HBA Driver", /* Name of the module. */
    400 	&esp_ops,	/* driver ops */
    401 };
    402 
    403 static struct modlinkage modlinkage = {
    404 	MODREV_1, (void *)&modldrv, NULL
    405 };
    406 
    407 int
    408 _init(void)
    409 {
    410 	int	i;
    411 
    412 	/* CONSTCOND */
    413 	ASSERT(NO_COMPETING_THREADS);
    414 
    415 	i = ddi_soft_state_init(&esp_state, sizeof (struct esp),
    416 	    ESP_INIT_SOFT_STATE);
    417 	if (i != 0)
    418 		return (i);
    419 	if ((i = scsi_hba_init(&modlinkage)) != 0) {
    420 		ddi_soft_state_fini(&esp_state);
    421 		return (i);
    422 	}
    423 
    424 	mutex_init(&esp_global_mutex, NULL, MUTEX_DRIVER, NULL);
    425 	rw_init(&esp_global_rwlock, NULL, RW_DRIVER, NULL);
    426 
    427 	mutex_init(&esp_log_mutex, NULL, MUTEX_DRIVER, NULL);
    428 
    429 	if ((i = mod_install(&modlinkage)) != 0) {
    430 		mutex_destroy(&esp_log_mutex);
    431 		rw_destroy(&esp_global_rwlock);
    432 		mutex_destroy(&esp_global_mutex);
    433 		ddi_soft_state_fini(&esp_state);
    434 		scsi_hba_fini(&modlinkage);
    435 		return (i);
    436 	}
    437 
    438 	return (i);
    439 }
    440 
    441 int
    442 _fini(void)
    443 {
    444 	int	i;
    445 
    446 	/* CONSTCOND */
    447 	ASSERT(NO_COMPETING_THREADS);
    448 	if ((i = mod_remove(&modlinkage)) == 0) {
    449 		mutex_destroy(&esp_log_mutex);
    450 		scsi_hba_fini(&modlinkage);
    451 		rw_destroy(&esp_global_rwlock);
    452 		mutex_destroy(&esp_global_mutex);
    453 		ddi_soft_state_fini(&esp_state);
    454 	}
    455 	return (i);
    456 }
    457 
    458 int
    459 _info(struct modinfo *modinfop)
    460 {
    461 	return (mod_info(&modlinkage, modinfop));
    462 }
    463 
    464 static int
    465 esp_scsi_tgt_probe(struct scsi_device *sd,
    466     int (*waitfunc)(void))
    467 {
    468 	dev_info_t *dip = ddi_get_parent(sd->sd_dev);
    469 	int rval = SCSIPROBE_FAILURE;
    470 	scsi_hba_tran_t *tran;
    471 	struct esp *esp;
    472 	int tgt = sd->sd_address.a_target;
    473 
    474 	tran = ddi_get_driver_private(dip);
    475 	ASSERT(tran != NULL);
    476 	esp = TRAN2ESP(tran);
    477 
    478 	/*
    479 	 * force renegotiation since Inquiry cmds do not cause
    480 	 * check conditions
    481 	 */
    482 	mutex_enter(ESP_MUTEX);
    483 	esp->e_sync_known &= ~(1 << tgt);
    484 	mutex_exit(ESP_MUTEX);
    485 
    486 	rval = scsi_hba_probe(sd, waitfunc);
    487 
    488 	/*
    489 	 * the scsi-options precedence is:
    490 	 *	target-scsi-options		highest
    491 	 *	device-type-scsi-options
    492 	 *	per bus scsi-options
    493 	 *	global scsi-options		lowest
    494 	 */
    495 	mutex_enter(ESP_MUTEX);
    496 	if ((rval == SCSIPROBE_EXISTS) &&
    497 	    ((esp->e_target_scsi_options_defined & (1 << tgt)) == 0)) {
    498 		int options;
    499 
    500 		options = scsi_get_device_type_scsi_options(dip, sd, -1);
    501 		if (options != -1) {
    502 			esp->e_target_scsi_options[tgt] = options;
    503 			esplog(esp, CE_NOTE,
    504 			    "?target%x-scsi-options = 0x%x\n", tgt,
    505 			    esp->e_target_scsi_options[tgt]);
    506 
    507 			if (options & SCSI_OPTIONS_FAST) {
    508 				esp->e_default_period[tgt] = (uchar_t)
    509 				    MIN_SYNC_PERIOD(esp);
    510 			} else {
    511 				esp->e_default_period[tgt] = (uchar_t)
    512 				    CONVERT_PERIOD(DEFAULT_SYNC_PERIOD);
    513 			}
    514 			esp->e_neg_period[tgt] = 0;
    515 			esp->e_sync_known &= ~(1 << tgt);
    516 		}
    517 	}
    518 	mutex_exit(ESP_MUTEX);
    519 
    520 	IPRINTF2("target%x-scsi-options = 0x%x\n",
    521 	    tgt, esp->e_target_scsi_options[tgt]);
    522 
    523 	return (rval);
    524 }
    525 
    526 
    527 /*ARGSUSED*/
    528 static int
    529 esp_scsi_tgt_init(dev_info_t *hba_dip, dev_info_t *tgt_dip,
    530     scsi_hba_tran_t *hba_tran, struct scsi_device *sd)
    531 {
    532 	return (((sd->sd_address.a_target < NTARGETS) &&
    533 	    (sd->sd_address.a_lun < NLUNS_PER_TARGET)) ?
    534 	    DDI_SUCCESS : DDI_FAILURE);
    535 }
    536 
    537 static char *prop_cfreq = "clock-frequency";
    538 
    539 /*ARGSUSED*/
    540 static int
    541 esp_attach(dev_info_t *dip, ddi_attach_cmd_t cmd)
    542 {
    543 	struct esp *esp;
    544 	volatile struct dmaga *dmar = NULL;
    545 	volatile struct espreg *ep;
    546 	ddi_dma_attr_t	*esp_dma_attr;
    547 	scsi_hba_tran_t *tran = NULL;
    548 	ddi_device_acc_attr_t dev_attr;
    549 
    550 	int		instance, i;
    551 	char		buf[64];
    552 	int		mutex_initialized = 0;
    553 	int		add_intr_done = 0;
    554 	int		bound_handle = 0;
    555 	uint_t		count;
    556 	size_t		rlen;
    557 	char		*prop_template = "target%d-scsi-options";
    558 	char		prop_str[32];
    559 
    560 	switch (cmd) {
    561 	case DDI_ATTACH:
    562 		break;
    563 
    564 	case DDI_RESUME:
    565 	case DDI_PM_RESUME:
    566 		if ((tran = ddi_get_driver_private(dip)) == NULL)
    567 			return (DDI_FAILURE);
    568 
    569 		esp = TRAN2ESP(tran);
    570 		if (!esp) {
    571 			return (DDI_FAILURE);
    572 		}
    573 		mutex_enter(ESP_MUTEX);
    574 
    575 		/*
    576 		 * Reset hardware and softc to "no outstanding commands"
    577 		 * Note that a check condition can result on first command
    578 		 * to a target.
    579 		 */
    580 		esp_internal_reset(esp,
    581 		    ESP_RESET_SOFTC|ESP_RESET_ESP|ESP_RESET_DMA);
    582 		(void) esp_reset_bus(esp);
    583 
    584 		/*
    585 		 * esp_watchdog_running was reset at checkpoint time,
    586 		 * enable it at resume time
    587 		 */
    588 		esp_watchdog_running = 1;
    589 
    590 		esp->e_suspended = 0;
    591 
    592 		mutex_enter(&esp_global_mutex);
    593 		if (esp_timeout_id == 0) {
    594 			esp_timeout_id = timeout(esp_watch, NULL, esp_tick);
    595 			esp_timeout_initted = 1;
    596 		}
    597 		mutex_exit(&esp_global_mutex);
    598 
    599 		/* make sure that things get started */
    600 		(void) esp_istart(esp);
    601 		ESP_CHECK_STARTQ_AND_ESP_MUTEX_EXIT(esp);
    602 		return (DDI_SUCCESS);
    603 
    604 	default:
    605 		return (DDI_FAILURE);
    606 	}
    607 
    608 	instance = ddi_get_instance(dip);
    609 
    610 	/*
    611 	 * Since we know that some instantiations of this device can
    612 	 * be plugged into slave-only SBus slots, check to see whether
    613 	 * this is one such.
    614 	 */
    615 	if (ddi_slaveonly(dip) == DDI_SUCCESS) {
    616 		cmn_err(CE_WARN,
    617 		    "esp%d: device in slave-only slot", instance);
    618 		return (DDI_FAILURE);
    619 	}
    620 
    621 	if (ddi_intr_hilevel(dip, 0)) {
    622 		/*
    623 		 * Interrupt number '0' is a high-level interrupt.
    624 		 * At this point you either add a special interrupt
    625 		 * handler that triggers a soft interrupt at a lower level,
    626 		 * or - more simply and appropriately here - you just
    627 		 * fail the attach.
    628 		 */
    629 		cmn_err(CE_WARN,
    630 		    "esp%d: Device is using a hilevel intr", instance);
    631 		return (DDI_FAILURE);
    632 	}
    633 
    634 	/*
    635 	 * Allocate softc information.
    636 	 */
    637 	if (ddi_soft_state_zalloc(esp_state, instance) != DDI_SUCCESS) {
    638 		cmn_err(CE_WARN,
    639 		    "esp%d: cannot allocate soft state", instance);
    640 		return (DDI_FAILURE);
    641 	}
    642 
    643 	esp = (struct esp *)ddi_get_soft_state(esp_state, instance);
    644 
    645 	if (esp == NULL) {
    646 		return (DDI_FAILURE);
    647 	}
    648 
    649 	/*
    650 	 * map in device registers
    651 	 */
    652 	dev_attr.devacc_attr_version = DDI_DEVICE_ATTR_V0;
    653 	dev_attr.devacc_attr_endian_flags = DDI_NEVERSWAP_ACC;
    654 	dev_attr.devacc_attr_dataorder = DDI_STRICTORDER_ACC;
    655 
    656 	if (ddi_regs_map_setup(dip, (uint_t)0, (caddr_t *)&ep,
    657 	    (off_t)0, (off_t)sizeof (struct espreg),
    658 	    &dev_attr, &esp->e_regs_acc_handle) != DDI_SUCCESS) {
    659 		cmn_err(CE_WARN, "esp%d: unable to map registers", instance);
    660 		goto exit;
    661 	}
    662 
    663 	dmar = dma_alloc(dip);
    664 	if (dmar == NULL) {
    665 		cmn_err(CE_WARN,
    666 		    "esp%d: cannot find dma controller", instance);
    667 		goto unmap;
    668 	}
    669 
    670 	/*
    671 	 * Initialize state of DMA gate array.
    672 	 * Must clear DMAGA_RESET on the ESC before accessing the esp.
    673 	 */
    674 	switch (DMAGA_REV(dmar)) {
    675 	case DMA_REV2:
    676 		esp_dma_attr = &dma2_espattr;
    677 		break;
    678 	case ESC1_REV1:
    679 		dmar->dmaga_csr &= ~DMAGA_RESET;
    680 		esp_dma_attr = &esc1_espattr;
    681 		break;
    682 	case DMA_REV3:
    683 		esp_dma_attr = &dma3_espattr;
    684 		break;
    685 	case DMA_REV1:
    686 	default:
    687 		esp_dma_attr = &dma1_espattr;
    688 		break;
    689 	}
    690 
    691 	dmar->dmaga_csr &= ~DMAGA_WRITE;
    692 
    693 	if (ddi_dma_alloc_handle(dip, esp_dma_attr,
    694 	    DDI_DMA_SLEEP, NULL, &esp->e_dmahandle) != DDI_SUCCESS) {
    695 		cmn_err(CE_WARN,
    696 		    "esp%d: cannot alloc dma handle", instance);
    697 		goto fail;
    698 	}
    699 
    700 	if (ddi_dma_mem_alloc(esp->e_dmahandle, (uint_t)FIFOSIZE,
    701 	    &dev_attr, DDI_DMA_CONSISTENT, DDI_DMA_SLEEP,
    702 	    NULL, (caddr_t *)&esp->e_cmdarea, &rlen,
    703 	    &esp->e_cmdarea_acc_handle) != DDI_SUCCESS) {
    704 		cmn_err(CE_WARN,
    705 		    "esp%d: cannot alloc cmd area", instance);
    706 		goto fail;
    707 	}
    708 	ASSERT(rlen >= FIFOSIZE);
    709 
    710 	if (ddi_dma_addr_bind_handle(esp->e_dmahandle,
    711 	    NULL, (caddr_t)esp->e_cmdarea,
    712 	    rlen, DDI_DMA_RDWR|DDI_DMA_CONSISTENT, DDI_DMA_SLEEP, NULL,
    713 	    &esp->e_dmacookie, &count) != DDI_DMA_MAPPED) {
    714 		cmn_err(CE_WARN,
    715 		    "esp%d: cannot bind cmdarea", instance);
    716 		goto fail;
    717 	}
    718 	bound_handle++;
    719 	ASSERT(count == 1);
    720 
    721 	/*
    722 	 * Allocate a transport structure
    723 	 */
    724 	tran = scsi_hba_tran_alloc(dip, SCSI_HBA_CANSLEEP);
    725 
    726 	/* Indicate that we are 'sizeof (scsi_*(9S))' clean. */
    727 	scsi_size_clean(dip);		/* SCSI_SIZE_CLEAN_VERIFY ok */
    728 
    729 	/*
    730 	 * the ESC has a rerun bug and the workaround is
    731 	 * to round up the ESC count; rather than
    732 	 * doing this on each xfer we do it once here
    733 	 * for the cmd area read xfers
    734 	 */
    735 	esp->e_dma_rev = DMAGA_REV(dmar);
    736 	if (esp->e_dma_rev == ESC1_REV1) {
    737 		uint32_t addr1 = esp->e_dmacookie.dmac_address;
    738 		uint32_t addr2 = roundup(addr1 + FIFOSIZE, ptob(1));
    739 		esp->e_esc_read_count = (uint32_t)(addr2 - addr1);
    740 	}
    741 
    742 	/*
    743 	 * By default we assume embedded devices and save time
    744 	 * checking for timeouts in esp_watch() by skipping the rest of luns
    745 	 * If we're talking to any non-embedded devices, we can't cheat
    746 	 * and skip over non-zero luns anymore in esp_watch().
    747 	 */
    748 	esp->e_dslot = NLUNS_PER_TARGET;
    749 
    750 #ifdef	ESPDEBUG
    751 	/*
    752 	 * Initialize last state log.
    753 	 */
    754 	for (i = 0; i < NPHASE; i++) {
    755 		esp->e_phase[i].e_save_state = STATE_FREE;
    756 		esp->e_phase[i].e_save_stat = -1;
    757 		esp->e_phase[i].e_val1 = -1;
    758 		esp->e_phase[i].e_val2 = -1;
    759 	}
    760 	esp->e_phase_index = 0;
    761 	esp->e_xfer = 0;
    762 #endif	/* ESPDEBUG */
    763 
    764 	/*
    765 	 * Initialize throttles.
    766 	 */
    767 	esp_set_throttles(esp, 0, N_SLOTS, CLEAR_THROTTLE);
    768 
    769 	/*
    770 	 * initialize transport structure
    771 	 */
    772 	esp->e_tran			= tran;
    773 	esp->e_dev			= dip;
    774 
    775 	tran->tran_hba_private		= esp;
    776 	tran->tran_tgt_private		= NULL;
    777 
    778 	tran->tran_tgt_init		= esp_scsi_tgt_init;
    779 	tran->tran_tgt_probe		= esp_scsi_tgt_probe;
    780 	tran->tran_tgt_free		= NULL;
    781 
    782 	tran->tran_start		= esp_start;
    783 	tran->tran_abort		= esp_abort;
    784 	tran->tran_reset		= esp_reset;
    785 	tran->tran_getcap		= esp_getcap;
    786 	tran->tran_setcap		= esp_setcap;
    787 	tran->tran_init_pkt		= esp_scsi_init_pkt;
    788 	tran->tran_destroy_pkt		= esp_scsi_destroy_pkt;
    789 	tran->tran_dmafree		= esp_scsi_dmafree;
    790 	tran->tran_sync_pkt		= esp_scsi_sync_pkt;
    791 	tran->tran_reset_notify		= esp_scsi_reset_notify;
    792 	tran->tran_get_bus_addr		= NULL;
    793 	tran->tran_get_name		= NULL;
    794 	tran->tran_add_eventcall	= NULL;
    795 	tran->tran_get_eventcookie	= NULL;
    796 	tran->tran_post_event		= NULL;
    797 	tran->tran_remove_eventcall	= NULL;
    798 
    799 	/* XXX need tran_quiesce and tran_unquiesce for hotplugging */
    800 	tran->tran_bus_reset		= NULL;
    801 	tran->tran_quiesce		= NULL;
    802 	tran->tran_unquiesce		= NULL;
    803 
    804 	esp->e_espconf = DEFAULT_HOSTID;
    805 	i = ddi_prop_get_int(DDI_DEV_T_ANY, dip, 0, "initiator-id", -1);
    806 	if (i == -1) {
    807 		i = ddi_prop_get_int(DDI_DEV_T_ANY, dip, 0,
    808 		    "scsi-initiator-id", -1);
    809 	}
    810 	if (i != DEFAULT_HOSTID && i >= 0 && i < NTARGETS) {
    811 		esplog(esp, CE_NOTE, "initiator SCSI ID now %d\n", i);
    812 		esp->e_espconf = (uchar_t)i;
    813 	}
    814 
    815 	for (i = 0; i < NTARGETS; i++) {
    816 		esp->e_qfull_retries[i] = QFULL_RETRIES;
    817 		esp->e_qfull_retry_interval[i] =
    818 		    drv_usectohz(QFULL_RETRY_INTERVAL * 1000);
    819 	}
    820 
    821 	esp->e_reg = ep;
    822 	esp->e_dma = dmar;
    823 	esp->e_last_slot = esp->e_cur_slot = UNDEFINED;
    824 
    825 	IPRINTF1("DMA Rev: 0x%x\n", ESP_DMAGA_REV(esp));
    826 
    827 	esp->e_dma_attr = esp_dma_attr;
    828 	IPRINTF1("esp_dma_attr burstsize=%x\n",
    829 	    esp_dma_attr->dma_attr_burstsizes);
    830 
    831 	/*
    832 	 * Attach this instance of the hba
    833 	 */
    834 	if (scsi_hba_attach_setup(dip, esp->e_dma_attr, tran, 0) !=
    835 	    DDI_SUCCESS) {
    836 		cmn_err(CE_WARN, "esp: scsi_hba_attach failed\n");
    837 		goto fail;
    838 	}
    839 
    840 	/*
    841 	 * if scsi-options property exists, use it;
    842 	 * otherwise use the global variable
    843 	 */
    844 	esp->e_scsi_options = ddi_prop_get_int(DDI_DEV_T_ANY, dip, 0,
    845 	    "scsi-options", SCSI_OPTIONS_DR);
    846 
    847 	/* we don't support wide */
    848 	if (esp->e_scsi_options & SCSI_OPTIONS_WIDE) {
    849 		esp->e_scsi_options &= ~SCSI_OPTIONS_WIDE;
    850 		(void) ddi_prop_update_int(DDI_MAJOR_T_UNKNOWN, dip,
    851 		    "scsi-options", esp->e_scsi_options);
    852 	}
    853 
    854 	if ((esp->e_scsi_options & SCSI_OPTIONS_SYNC) == 0) {
    855 		esp->e_weak = 0xff;
    856 	}
    857 
    858 	/*
    859 	 * if scsi-selection-timeout property exists, use it
    860 	 */
    861 	esp_selection_timeout = ddi_prop_get_int(DDI_DEV_T_ANY,
    862 	    dip, 0, "scsi-selection-timeout", SCSI_DEFAULT_SELECTION_TIMEOUT);
    863 
    864 #ifdef ESPDEBUG
    865 	if ((esp->e_scsi_options & SCSI_DEBUG_HA) && (espdebug == 0)) {
    866 		espdebug = 1;
    867 	}
    868 #endif
    869 
    870 	/*
    871 	 * if target<n>-scsi-options property exists, use it;
    872 	 * otherwise use the e_scsi_options
    873 	 */
    874 	for (i = 0; i < NTARGETS; i++) {
    875 		(void) sprintf(prop_str, prop_template, i);
    876 		esp->e_target_scsi_options[i] = ddi_prop_get_int(
    877 		    DDI_DEV_T_ANY, dip, 0, prop_str, -1);
    878 		if (esp->e_target_scsi_options[i] != -1) {
    879 			esplog(esp, CE_NOTE,
    880 			    "?target%d_scsi_options=0x%x\n",
    881 			    i, esp->e_target_scsi_options[i]);
    882 			esp->e_target_scsi_options_defined |= 1 << i;
    883 		} else {
    884 			esp->e_target_scsi_options[i] = esp->e_scsi_options;
    885 		}
    886 
    887 		if (((esp->e_target_scsi_options[i] & SCSI_OPTIONS_DR) == 0) &&
    888 		    (esp->e_target_scsi_options[i] & SCSI_OPTIONS_TAG)) {
    889 			esp->e_target_scsi_options[i] &= ~SCSI_OPTIONS_TAG;
    890 			esplog(esp, CE_WARN,
    891 			    "Disabled TQ since disconnects are disabled\n");
    892 		}
    893 	}
    894 
    895 	esp->e_scsi_tag_age_limit =
    896 	    ddi_prop_get_int(DDI_DEV_T_ANY, dip, 0, "scsi-tag-age-limit",
    897 	    scsi_tag_age_limit);
    898 	IPRINTF2("esp tag age limit=%d, global=%d\n",
    899 	    esp->e_scsi_tag_age_limit, scsi_tag_age_limit);
    900 	if (esp->e_scsi_tag_age_limit != scsi_tag_age_limit) {
    901 		esplog(esp, CE_NOTE, "scsi-tag-age-limit=%d\n",
    902 		    esp->e_scsi_tag_age_limit);
    903 	}
    904 
    905 	esp->e_scsi_reset_delay = ddi_prop_get_int(DDI_DEV_T_ANY, dip, 0,
    906 	    "scsi-reset-delay", scsi_reset_delay);
    907 	IPRINTF2("esp scsi_reset_delay=%x, global=%x\n",
    908 	    esp->e_scsi_reset_delay, scsi_reset_delay);
    909 	if (esp->e_scsi_reset_delay == 0) {
    910 		esplog(esp, CE_NOTE,
    911 		    "scsi_reset_delay of 0 is not recommended,"
    912 		    " resetting to SCSI_DEFAULT_RESET_DELAY\n");
    913 		esp->e_scsi_reset_delay = SCSI_DEFAULT_RESET_DELAY;
    914 	}
    915 	if (esp->e_scsi_reset_delay != scsi_reset_delay) {
    916 		esplog(esp, CE_NOTE, "scsi-reset-delay=%d\n",
    917 		    esp->e_scsi_reset_delay);
    918 	}
    919 
    920 	esp->e_force_async = 0;
    921 	/*
    922 	 * disable tagged queuing for all targets
    923 	 * (will be enabled by target driver if necessary)
    924 	 */
    925 	esp->e_notag = 0xff;
    926 
    927 	/*
    928 	 * get iblock cookie and initialize mutexes
    929 	 */
    930 	if (ddi_get_iblock_cookie(dip, (uint_t)0, &esp->e_iblock)
    931 	    != DDI_SUCCESS) {
    932 		cmn_err(CE_WARN, "esp_attach: cannot get iblock cookie");
    933 		goto fail;
    934 	}
    935 
    936 	mutex_init(ESP_MUTEX, NULL, MUTEX_DRIVER, esp->e_iblock);
    937 
    938 	/*
    939 	 * initialize mutex for startQ
    940 	 */
    941 	mutex_init(&esp->e_startQ_mutex, NULL, MUTEX_DRIVER, esp->e_iblock);
    942 
    943 	/*
    944 	 * add this esp to the linked list of esp's
    945 	 */
    946 	rw_enter(&esp_global_rwlock, RW_WRITER);
    947 	if (esp_softc == (struct esp *)NULL) {
    948 		esp_softc = esp;
    949 	} else {
    950 		esp_tail->e_next = esp;
    951 	}
    952 	esp_tail = esp;		/* point to last esp in list */
    953 	rw_exit(&esp_global_rwlock);
    954 	mutex_initialized++;
    955 
    956 	/*
    957 	 * kstat_intr support
    958 	 */
    959 	(void) sprintf(buf, "esp%d", instance);
    960 	esp->e_intr_kstat = kstat_create("esp", instance, buf, "controller", \
    961 	    KSTAT_TYPE_INTR, 1, KSTAT_FLAG_PERSISTENT);
    962 	if (esp->e_intr_kstat)
    963 		kstat_install(esp->e_intr_kstat);
    964 
    965 	if (ddi_add_intr(dip, (uint_t)0, &esp->e_iblock, NULL, esp_intr,
    966 	    (caddr_t)esp)) {
    967 		cmn_err(CE_WARN, "esp: cannot add intr");
    968 		goto fail;
    969 	}
    970 	add_intr_done++;
    971 
    972 	/*
    973 	 * finally, find out what kind of ESP/FAS chip we have here
    974 	 * now we are ready to take the reset interrupt
    975 	 */
    976 	esp_determine_chip_type(esp);
    977 
    978 	/*
    979 	 * start off one watchdog for all esp's now we are fully initialized
    980 	 */
    981 	if (esp_softc == esp) {
    982 		esp_scsi_watchdog_tick =
    983 		    ddi_prop_get_int(DDI_DEV_T_ANY, dip, 0,
    984 		    "scsi-watchdog-tick", scsi_watchdog_tick);
    985 		if (esp_scsi_watchdog_tick != scsi_watchdog_tick) {
    986 			esplog(esp, CE_NOTE, "scsi-watchdog-tick=%d\n",
    987 			    esp_scsi_watchdog_tick);
    988 		}
    989 		esp_tick = drv_usectohz((clock_t)
    990 		    esp_scsi_watchdog_tick * 1000000);
    991 		IPRINTF2("esp scsi watchdog tick=%x, esp_tick=%lx\n",
    992 		    esp_scsi_watchdog_tick, esp_tick);
    993 		mutex_enter(&esp_global_mutex);
    994 		if (esp_timeout_id == 0) {
    995 			esp_timeout_id = timeout(esp_watch, NULL, esp_tick);
    996 			esp_timeout_initted = 1;
    997 		}
    998 		mutex_exit(&esp_global_mutex);
    999 	}
   1000 
   1001 	/*
   1002 	 * Initialize power management bookkeeping; components are
   1003 	 * created idle
   1004 	 */
   1005 
   1006 	/*
   1007 	 * Since as of now, there is no power management done in
   1008 	 * scsi-HBA drivers, there is no need to create a pm_component.
   1009 	 * BUT esp is a special case with GYPSY. In gypsy, the
   1010 	 * PM_SUSPEND/PM_RESUME is used. So, the following few lines
   1011 	 * of code will be there until Gypsy machines are supported.
   1012 	 */
   1013 
   1014 	if (pm_create_components(dip, 1) == DDI_SUCCESS) {
   1015 		pm_set_normal_power(dip, 0, 1);
   1016 	} else {
   1017 		goto fail;
   1018 	}
   1019 
   1020 #ifdef ESP_KSTATS
   1021 	/*
   1022 	 * kstats to measure scsi bus busy time
   1023 	 */
   1024 	if (esp_do_bus_kstats) {
   1025 		if ((esp->e_scsi_bus_stats = kstat_create("esp-scsi-bus",
   1026 		    instance, NULL, "disk", KSTAT_TYPE_IO, 1,
   1027 		    KSTAT_FLAG_PERSISTENT)) != NULL) {
   1028 			esp->e_scsi_bus_stats->ks_lock = ESP_MUTEX;
   1029 			kstat_install(esp->e_scsi_bus_stats);
   1030 		}
   1031 	}
   1032 #endif /* ESP_KSTATS */
   1033 
   1034 	/*
   1035 	 * create a possibly shared callback thread which will empty the
   1036 	 * callback queue
   1037 	 */
   1038 	mutex_enter(&esp_global_mutex);
   1039 	esp_create_callback_thread(esp);
   1040 	mutex_exit(&esp_global_mutex);
   1041 
   1042 	/*
   1043 	 * create kmem cache for packets
   1044 	 */
   1045 	(void) sprintf(buf, "esp%d_cache", instance);
   1046 	esp->e_kmem_cache = kmem_cache_create(buf,
   1047 	    ESP_CMD_SIZE, 8,
   1048 	    esp_kmem_cache_constructor, esp_kmem_cache_destructor,
   1049 	    NULL, (void *)esp, NULL, 0);
   1050 	if (esp->e_kmem_cache == NULL) {
   1051 		cmn_err(CE_WARN, "esp: cannot create kmem_cache");
   1052 		goto fail;
   1053 	}
   1054 
   1055 	ddi_report_dev(dip);
   1056 
   1057 	return (DDI_SUCCESS);
   1058 
   1059 fail:
   1060 	cmn_err(CE_WARN, "esp%d: cannot attach", instance);
   1061 	if (esp) {
   1062 		struct esp *next, *prev;
   1063 
   1064 		/* remove this esp from the linked list */
   1065 		rw_enter(&esp_global_rwlock, RW_WRITER);
   1066 		for (prev = NULL,  next = esp_softc; next != NULL;
   1067 		    prev = next, next = next->e_next) {
   1068 			if (next == esp) {
   1069 				if (next == esp_softc) {
   1070 					esp_softc = esp->e_next;
   1071 				} else {
   1072 					prev->e_next = esp->e_next;
   1073 				}
   1074 				if (esp_tail == esp) {
   1075 					esp_tail = prev;
   1076 				}
   1077 				break;
   1078 			}
   1079 		}
   1080 		rw_exit(&esp_global_rwlock);
   1081 
   1082 		if (mutex_initialized) {
   1083 			mutex_destroy(&esp->e_startQ_mutex);
   1084 			mutex_destroy(ESP_MUTEX);
   1085 		}
   1086 		if (esp->e_intr_kstat) {
   1087 			kstat_delete(esp->e_intr_kstat);
   1088 		}
   1089 		if (add_intr_done) {
   1090 			ddi_remove_intr(dip, (uint_t)0, esp->e_iblock);
   1091 		}
   1092 		if (tran) {
   1093 			scsi_hba_tran_free(tran);
   1094 		}
   1095 		if (esp->e_kmem_cache) {
   1096 			kmem_cache_destroy(esp->e_kmem_cache);
   1097 		}
   1098 		if (esp->e_cmdarea) {
   1099 			if (bound_handle) {
   1100 				(void) ddi_dma_unbind_handle(esp->e_dmahandle);
   1101 			}
   1102 			ddi_dma_mem_free(&esp->e_cmdarea_acc_handle);
   1103 		}
   1104 		if (esp->e_dmahandle) {
   1105 			ddi_dma_free_handle(&esp->e_dmahandle);
   1106 		}
   1107 	}
   1108 
   1109 	if (dmar)
   1110 		dma_free((struct dmaga *)dmar);
   1111 unmap:
   1112 	if (esp->e_regs_acc_handle)
   1113 		ddi_regs_map_free(&esp->e_regs_acc_handle);
   1114 
   1115 exit:
   1116 	if (esp) {
   1117 		ddi_soft_state_free(esp_state, instance);
   1118 	}
   1119 
   1120 	return (DDI_FAILURE);
   1121 }
   1122 
   1123 /*ARGSUSED*/
   1124 static int
   1125 esp_detach(dev_info_t *dip, ddi_detach_cmd_t cmd)
   1126 {
   1127 	struct esp	*esp, *nesp;
   1128 	scsi_hba_tran_t		*tran;
   1129 
   1130 	switch (cmd) {
   1131 	case DDI_DETACH:
   1132 		return (esp_dr_detach(dip));
   1133 
   1134 	case DDI_SUSPEND:
   1135 	case DDI_PM_SUSPEND:
   1136 		if ((tran = ddi_get_driver_private(dip)) == NULL)
   1137 			return (DDI_FAILURE);
   1138 
   1139 		esp = TRAN2ESP(tran);
   1140 		if (!esp) {
   1141 			return (DDI_FAILURE);
   1142 		}
   1143 		mutex_enter(ESP_MUTEX);
   1144 
   1145 		esp->e_suspended = 1;
   1146 		esp_watchdog_running = 0;
   1147 
   1148 		if (esp->e_ncmds) {
   1149 			(void) esp_reset_bus(esp);
   1150 			(void) esp_dopoll(esp, SHORT_POLL_TIMEOUT);
   1151 		}
   1152 		/*
   1153 		 * In the current implementation of esp power management, the
   1154 		 * SCSI active terminators are turned off and so the bus
   1155 		 * signals can wander everywhere - including generating false
   1156 		 * interrupts, so they need to be disabled.  This should also
   1157 		 * be done for a full SUSPEND in theory, but since CPR writes
   1158 		 * out the state file....
   1159 		 */
   1160 		if (cmd == DDI_PM_SUSPEND) {
   1161 			esp->e_dmaga_csr &= ~DMAGA_INTEN;
   1162 			esp->e_dma->dmaga_csr = esp->e_dmaga_csr;
   1163 		}
   1164 		mutex_exit(ESP_MUTEX);
   1165 
   1166 		if (esp->e_restart_cmd_timeid) {
   1167 			(void) untimeout(esp->e_restart_cmd_timeid);
   1168 			esp->e_restart_cmd_timeid = 0;
   1169 		}
   1170 
   1171 		/* Last esp? */
   1172 		rw_enter(&esp_global_rwlock, RW_WRITER);
   1173 		for (nesp = esp_softc; nesp; nesp = nesp->e_next) {
   1174 			if (!nesp->e_suspended) {
   1175 				rw_exit(&esp_global_rwlock);
   1176 				return (DDI_SUCCESS);
   1177 			}
   1178 		}
   1179 		rw_exit(&esp_global_rwlock);
   1180 
   1181 		mutex_enter(&esp_global_mutex);
   1182 		if (esp_timeout_initted) {
   1183 			timeout_id_t tid = esp_timeout_id;
   1184 			esp_timeout_initted = 0;
   1185 			esp_timeout_id = 0;		/* don't resched */
   1186 			mutex_exit(&esp_global_mutex);
   1187 			(void) untimeout(tid);
   1188 			mutex_enter(&esp_global_mutex);
   1189 		}
   1190 
   1191 		if (esp_reset_watch) {
   1192 			mutex_exit(&esp_global_mutex);
   1193 			(void) untimeout(esp_reset_watch);
   1194 			mutex_enter(&esp_global_mutex);
   1195 			esp_reset_watch = 0;
   1196 		}
   1197 		mutex_exit(&esp_global_mutex);
   1198 
   1199 		return (DDI_SUCCESS);
   1200 
   1201 	default:
   1202 		return (DDI_FAILURE);
   1203 	}
   1204 	_NOTE(NOT_REACHED)
   1205 	/* NOTREACHED */
   1206 }
   1207 
   1208 static int
   1209 esp_dr_detach(dev_info_t *dev)
   1210 {
   1211 	struct esp	*esp, *e;
   1212 	scsi_hba_tran_t		*tran;
   1213 	int			i, j;
   1214 
   1215 	if ((tran = ddi_get_driver_private(dev)) == NULL)
   1216 		return (DDI_FAILURE);
   1217 
   1218 	esp = TRAN2ESP(tran);
   1219 	if (!esp) {
   1220 		return (DDI_FAILURE);
   1221 	}
   1222 
   1223 	/*
   1224 	 * Force interrupts OFF
   1225 	 */
   1226 	esp->e_dmaga_csr &= ~DMAGA_INTEN;
   1227 	esp->e_dma->dmaga_csr = esp->e_dmaga_csr;
   1228 	ddi_remove_intr(dev, (uint_t)0, esp->e_iblock);
   1229 
   1230 #ifdef ESP_KSTATS
   1231 	/*
   1232 	 * Remove kstats if any i.e., if pointer non-NULL.
   1233 	 * Note: pointer NOT explicitly NULL'ed. But buffer zalloc'd
   1234 	 */
   1235 	if (esp->e_scsi_bus_stats != (struct kstat *)NULL) {
   1236 		kmutex_t *lp = esp->e_scsi_bus_stats->ks_lock;
   1237 		if ((lp != (kmutex_t *)NULL) && !MUTEX_HELD(lp))
   1238 			kstat_delete(esp->e_scsi_bus_stats);
   1239 	}
   1240 #endif /* ESP_KSTATS */
   1241 
   1242 	/*
   1243 	 * deallocate reset notify callback list
   1244 	 */
   1245 	scsi_hba_reset_notify_tear_down(esp->e_reset_notify_listf);
   1246 
   1247 	/*
   1248 	 * Remove device instance from the global linked list
   1249 	 */
   1250 	rw_enter(&esp_global_rwlock, RW_WRITER);
   1251 
   1252 	if (esp_softc == esp) {
   1253 		e = esp_softc = esp->e_next;
   1254 	} else {
   1255 		for (e = esp_softc; e != (struct esp *)NULL; e = e->e_next) {
   1256 			if (e->e_next == esp) {
   1257 				e->e_next = esp->e_next;
   1258 				break;
   1259 			}
   1260 		}
   1261 		if (e == (struct esp *)NULL) {
   1262 			/*
   1263 			 * Instance not in softc list. Since the
   1264 			 * instance is not there in softc list, don't
   1265 			 * enable interrupts, the instance is effectively
   1266 			 * unusable.
   1267 			 */
   1268 			cmn_err(CE_WARN, "esp_dr_detach: esp instance not"
   1269 			    " in softc list!");
   1270 			rw_exit(&esp_global_rwlock);
   1271 			return (DDI_FAILURE);
   1272 		}
   1273 	}
   1274 
   1275 	if (esp_tail == esp)
   1276 		esp_tail = e;
   1277 
   1278 	rw_exit(&esp_global_rwlock);
   1279 
   1280 	if (esp->e_intr_kstat)
   1281 		kstat_delete(esp->e_intr_kstat);
   1282 
   1283 	/*
   1284 	 * disallow timeout thread rescheduling
   1285 	 */
   1286 	mutex_enter(&esp_global_mutex);
   1287 	esp->e_flags |= ESP_FLG_NOTIMEOUTS;
   1288 	mutex_exit(&esp_global_mutex);
   1289 
   1290 	/*
   1291 	 * last esp? ... if active, CANCEL watch threads.
   1292 	 */
   1293 	if (esp_softc == (struct esp *)NULL) {
   1294 		mutex_enter(&esp_global_mutex);
   1295 		if (esp_timeout_initted) {
   1296 			timeout_id_t tid = esp_timeout_id;
   1297 			esp_timeout_initted = 0;
   1298 			esp_timeout_id = 0;		/* don't resched */
   1299 			mutex_exit(&esp_global_mutex);
   1300 			(void) untimeout(tid);
   1301 			mutex_enter(&esp_global_mutex);
   1302 		}
   1303 
   1304 		if (esp_reset_watch) {
   1305 			mutex_exit(&esp_global_mutex);
   1306 			(void) untimeout(esp_reset_watch);
   1307 			mutex_enter(&esp_global_mutex);
   1308 			esp_reset_watch = 0;
   1309 		}
   1310 		mutex_exit(&esp_global_mutex);
   1311 	}
   1312 
   1313 	if (esp->e_restart_cmd_timeid) {
   1314 		(void) untimeout(esp->e_restart_cmd_timeid);
   1315 		esp->e_restart_cmd_timeid = 0;
   1316 	}
   1317 
   1318 	/*
   1319 	 * destroy outstanding ARQ pkts
   1320 	 */
   1321 	for (i = 0; i < NTARGETS; i++) {
   1322 		for (j = 0; j < NLUNS_PER_TARGET; j++) {
   1323 			int slot = i * NLUNS_PER_TARGET | j;
   1324 			if (esp->e_arq_pkt[slot]) {
   1325 				struct scsi_address	sa;
   1326 				sa.a_hba_tran = NULL;	/* not used */
   1327 				sa.a_target = (ushort_t)i;
   1328 				sa.a_lun = (uchar_t)j;
   1329 				(void) esp_create_arq_pkt(esp, &sa, 0);
   1330 			}
   1331 		}
   1332 	}
   1333 
   1334 	/*
   1335 	 * destroy any outstanding tagged command info
   1336 	 */
   1337 	for (i = 0; i < N_SLOTS; i++) {
   1338 		struct t_slots *active = esp->e_tagQ[i];
   1339 		if (active) {
   1340 			for (j = 0; j < NTAGS; j++) {
   1341 				struct esp_cmd *sp = active->t_slot[j];
   1342 				if (sp) {
   1343 					struct scsi_pkt *pkt = &sp->cmd_pkt;
   1344 					if (pkt) {
   1345 						esp_scsi_destroy_pkt(
   1346 						    &pkt->pkt_address, pkt);
   1347 					}
   1348 					/* sp freed in esp_scsi_destroy_pkt */
   1349 					active->t_slot[j] = NULL;
   1350 				}
   1351 			}
   1352 			kmem_free(active, sizeof (struct t_slots));
   1353 			esp->e_tagQ[i] = NULL;
   1354 		}
   1355 		ASSERT(esp->e_tcmds[i] == 0);
   1356 	}
   1357 
   1358 	/*
   1359 	 * Remove device MT locks
   1360 	 */
   1361 	mutex_destroy(&esp->e_startQ_mutex);
   1362 	mutex_destroy(ESP_MUTEX);
   1363 
   1364 	/*
   1365 	 * Release miscellaneous device resources
   1366 	 */
   1367 	if (esp->e_kmem_cache) {
   1368 		kmem_cache_destroy(esp->e_kmem_cache);
   1369 	}
   1370 
   1371 	if (esp->e_cmdarea != (uchar_t *)NULL) {
   1372 		(void) ddi_dma_unbind_handle(esp->e_dmahandle);
   1373 		ddi_dma_mem_free(&esp->e_cmdarea_acc_handle);
   1374 	}
   1375 
   1376 	if (esp->e_dmahandle != NULL)
   1377 		ddi_dma_free_handle(&esp->e_dmahandle);
   1378 
   1379 	if (esp->e_dma != (struct dmaga *)NULL)
   1380 		dma_free((struct dmaga *)esp->e_dma);
   1381 
   1382 	ddi_regs_map_free(&esp->e_regs_acc_handle);
   1383 
   1384 	esp_destroy_callback_thread(esp);
   1385 
   1386 	/*
   1387 	 * Process shared callback resources, as required.
   1388 	 * Update callback_thread bookkeeping.
   1389 	 */
   1390 	ddi_soft_state_free(esp_state, ddi_get_instance(dev));
   1391 
   1392 	/*
   1393 	 * Remove properties created during attach()
   1394 	 */
   1395 	ddi_prop_remove_all(dev);
   1396 
   1397 	/*
   1398 	 * Delete the DMA limits, transport vectors and remove the device
   1399 	 * links to the scsi_transport layer.
   1400 	 *	-- ddi_set_driver_private(dip, NULL)
   1401 	 */
   1402 	(void) scsi_hba_detach(dev);
   1403 
   1404 	/*
   1405 	 * Free the scsi_transport structure for this device.
   1406 	 */
   1407 	scsi_hba_tran_free(tran);
   1408 
   1409 	return (DDI_SUCCESS);
   1410 }
   1411 
   1412 /*
   1413  * Hardware and Software internal reset routines
   1414  */
   1415 static void
   1416 esp_determine_chip_type(struct esp *esp)
   1417 {
   1418 	int i;
   1419 	uchar_t clock_conv;
   1420 	clock_t ticks;
   1421 	volatile struct espreg *ep = esp->e_reg;
   1422 
   1423 	if (esp->e_scsi_options & SCSI_OPTIONS_PARITY)
   1424 		esp->e_espconf |= ESP_CONF_PAREN;
   1425 
   1426 	/*
   1427 	 * Determine clock frequency of attached ESP chip.
   1428 	 */
   1429 	i = ddi_prop_get_int(DDI_DEV_T_ANY, esp->e_dev, 0, prop_cfreq, -1);
   1430 
   1431 	/*
   1432 	 * Valid clock freqs. are between 10 and 40 MHz.  Otherwise
   1433 	 * presume 20 MHz. and complain.  (Notice, that we wrap to
   1434 	 * zero at 40 MHz.  Ick!)  This test should NEVER fail!
   1435 	 *
   1436 	 *	freq (MHz)	clock conversion factor
   1437 	 *	10		2
   1438 	 *	10.01-15	3
   1439 	 *	15.01-20	4
   1440 	 *	20.01-25	5
   1441 	 *	25.01-30	6
   1442 	 *	30.01-35	7
   1443 	 *	35.01-40	8 (0)
   1444 	 */
   1445 	if (i > FIVE_MEG) {
   1446 		clock_conv = (i + FIVE_MEG - 1)/ FIVE_MEG;
   1447 	} else {
   1448 		clock_conv = 0;
   1449 	}
   1450 	if (clock_conv < CLOCK_10MHZ || clock_conv > CLOCK_40MHZ) {
   1451 		esplog(esp, CE_WARN,
   1452 		    "Bad clock frequency- setting 20mhz, asynchronous mode");
   1453 		esp->e_weak = 0xff;
   1454 		clock_conv = CLOCK_20MHZ;
   1455 		i = TWENTY_MEG;
   1456 	}
   1457 
   1458 	esp->e_clock_conv = clock_conv;
   1459 	esp->e_clock_cycle = CLOCK_PERIOD(i);
   1460 	ticks = ESP_CLOCK_TICK(esp);
   1461 	esp->e_stval = ESP_CLOCK_TIMEOUT(ticks, esp_selection_timeout);
   1462 
   1463 	IPRINTF5("%d mhz, clock_conv %d, clock_cycle %d, ticks %ld, stval %d\n",
   1464 	    i, esp->e_clock_conv, esp->e_clock_cycle,
   1465 	    ticks, esp->e_stval);
   1466 
   1467 	ep->esp_conf2 = 0;
   1468 	ep->esp_conf2 = 0xa;
   1469 	if ((ep->esp_conf2 & 0xf) == 0xa) {
   1470 		esp->e_espconf2 = (uchar_t)ESP_CONF2_SCSI2;
   1471 		ep->esp_conf3 = 0;
   1472 		ep->esp_conf3 = 5;
   1473 		if (ep->esp_conf3 == 0x5) {
   1474 			for (i = 0; i < NTARGETS; i++) {
   1475 				esp->e_espconf3[i] = 0;
   1476 			}
   1477 			if (clock_conv > CLOCK_25MHZ) {
   1478 				/*
   1479 				 * do not enable FENABLE when using
   1480 				 * stacked cmds
   1481 				 * esp->e_espconf2 |= ESP_CONF2_FENABLE;
   1482 				 */
   1483 				ep->esp_conf2 = esp->e_espconf2;
   1484 				esp->e_type = FAST;
   1485 				IPRINTF("found FAST\n");
   1486 			} else {
   1487 				ep->esp_conf2 = esp->e_espconf2;
   1488 				esp->e_type = ESP236;
   1489 			}
   1490 			ep->esp_conf3 = 0;
   1491 		} else {
   1492 			ep->esp_conf2 = esp->e_espconf2;
   1493 			esp->e_type = ESP100A;
   1494 		}
   1495 	} else {
   1496 		esp->e_type = ESP100;
   1497 	}
   1498 
   1499 	for (i = 0; i < NTARGETS; i++) {
   1500 		if (esp->e_target_scsi_options[i] & SCSI_OPTIONS_FAST) {
   1501 			esp->e_default_period[i] = (uchar_t)
   1502 			    MIN_SYNC_PERIOD(esp);
   1503 		} else {
   1504 			esp->e_default_period[i] =
   1505 			    (uchar_t)CONVERT_PERIOD(DEFAULT_SYNC_PERIOD);
   1506 		}
   1507 	}
   1508 
   1509 	New_state(esp, ACTS_RESET);
   1510 
   1511 	/*
   1512 	 * Avoid resetting the scsi bus since this causes a few seconds
   1513 	 * delay per esp in boot and also causes busy conditions in some
   1514 	 * tape devices.
   1515 	 * we assume that with FAS devices, we probably have OBP 2.0 or
   1516 	 * higher which resets the bus before booting.
   1517 	 * worst case, we hang during the first probe and reset then
   1518 	 */
   1519 	if ((esp->e_type == FAST) && (esp->e_weak == 0)) {
   1520 		esp_internal_reset(esp,
   1521 		    ESP_RESET_SOFTC|ESP_RESET_ESP|ESP_RESET_DMA);
   1522 	} else {
   1523 		esp_internal_reset(esp, ESP_RESET_ALL);
   1524 	}
   1525 }
   1526 
   1527 static void
   1528 esp_flush_fifo(struct esp *esp)
   1529 {
   1530 	Esp_cmd(esp, CMD_FLUSH);
   1531 
   1532 	if (esp->e_options & ESP_OPT_SLOW_FIFO_FLUSH) {
   1533 		int i;
   1534 		for (i = 0; i < 1000; i++) {
   1535 			if (FIFO_CNT(esp->e_reg) == 0) {
   1536 				break;
   1537 			}
   1538 			drv_usecwait(1);
   1539 		}
   1540 		if (i >= 1000) {
   1541 			esplog(esp, CE_WARN, "fifo didn't flush\n");
   1542 		}
   1543 	}
   1544 }
   1545 
   1546 
   1547 static void
   1548 esp_internal_reset(struct esp *esp, int reset_action)
   1549 {
   1550 	if (reset_action & ESP_RESET_HW) {
   1551 		esp_hw_reset(esp, reset_action);
   1552 	}
   1553 
   1554 	if (reset_action & ESP_RESET_SOFTC) {
   1555 		esp->e_last_slot = esp->e_cur_slot;
   1556 		esp->e_cur_slot = UNDEFINED;
   1557 		bzero(esp->e_slots, (sizeof (struct esp_cmd *)) * N_SLOTS);
   1558 		bzero(esp->e_offset, NTARGETS * (sizeof (uchar_t)));
   1559 		bzero(esp->e_period, NTARGETS * (sizeof (uchar_t)));
   1560 		esp->e_sync_known = esp->e_omsglen = 0;
   1561 		esp->e_cur_msgout[0] = esp->e_last_msgout =
   1562 		    esp->e_last_msgin = INVALID_MSG;
   1563 		esp->e_espconf3_last = esp->e_offset_last =
   1564 		    esp->e_period_last = (uchar_t)-1;
   1565 
   1566 		/*
   1567 		 * esp->e_weak && esp->e_nodisc && ncmds && ndiscs  are
   1568 		 * preserved across softc resets.
   1569 		 */
   1570 		New_state(esp, STATE_FREE);
   1571 	}
   1572 	LOG_STATE(esp, ACTS_RESET, esp->e_stat, -1, reset_action);
   1573 }
   1574 
   1575 static void
   1576 esp_hw_reset(struct esp *esp, int action)
   1577 {
   1578 	volatile struct espreg *ep = esp->e_reg;
   1579 	volatile struct dmaga *dmar = esp->e_dma;
   1580 	uchar_t junk, i;
   1581 	int sbus_reruns;
   1582 
   1583 	/*
   1584 	 * never reset the dmaga while a request pending; this
   1585 	 * may cause a hang in xbox if there was a rerun pending
   1586 	 */
   1587 	if (action & ESP_RESET_SCSIBUS) {
   1588 		Esp_cmd(esp, CMD_RESET_SCSI);
   1589 		if (esp_watchdog_running && !panicstr) {
   1590 			int i;
   1591 
   1592 			esp_set_throttles(esp, 0, N_SLOTS, HOLD_THROTTLE);
   1593 			for (i = 0; i < NTARGETS; i++) {
   1594 				esp->e_reset_delay[i] =
   1595 				    esp->e_scsi_reset_delay;
   1596 			}
   1597 			esp_start_watch_reset_delay(esp);
   1598 		} else {
   1599 			drv_usecwait(esp->e_scsi_reset_delay * 1000);
   1600 		}
   1601 		ESP_FLUSH_DMA(esp);
   1602 	}
   1603 
   1604 	if (action & ESP_RESET_DMA) {
   1605 		int burstsizes = esp->e_dma_attr->dma_attr_burstsizes;
   1606 		burstsizes &= (ddi_dma_burstsizes(esp->e_dmahandle) &
   1607 		    esp_burst_sizes_limit);
   1608 
   1609 		ESP_FLUSH_DMA(esp);
   1610 		dmar->dmaga_csr = DMAGA_RESET;
   1611 		dmar->dmaga_csr &= ~DMAGA_RESET; /* clear it */
   1612 
   1613 		switch (ESP_DMAGA_REV(esp)) {
   1614 		case ESC1_REV1:
   1615 			sbus_reruns =
   1616 			    ddi_prop_exists(DDI_DEV_T_ANY, esp->e_dev, 0,
   1617 			    "reruns");
   1618 			if (sbus_reruns) {
   1619 				esp->e_options |= ESP_OPT_SBUS_RERUNS;
   1620 			}
   1621 			IPRINTF2("DMA Rev: 0x%x with %s\n", ESP_DMAGA_REV(esp),
   1622 			    sbus_reruns ? "SBus Reruns" : "No SBus Reruns");
   1623 
   1624 			if (!(burstsizes & BURST32)) {
   1625 				IPRINTF("16 byte burstsize\n");
   1626 				DMAESC_SETBURST16(dmar);
   1627 			}
   1628 			dmar->dmaga_csr |= DMAESC_EN_ADD;
   1629 			break;
   1630 
   1631 		case DMA_REV2:
   1632 			if (esp->e_type != ESP100)
   1633 				dmar->dmaga_csr |= DMAGA_TURBO;
   1634 			break;
   1635 
   1636 		case DMA_REV3:
   1637 			dmar->dmaga_csr &= ~DMAGA_TURBO;
   1638 			dmar->dmaga_csr |= DMAGA_TWO_CYCLE;
   1639 
   1640 			if (burstsizes & BURST32) {
   1641 				IPRINTF("32 byte burstsize\n");
   1642 				DMA2_SETBURST32(dmar);
   1643 			}
   1644 			break;
   1645 
   1646 		default:
   1647 			break;
   1648 		}
   1649 	}
   1650 
   1651 	dmar->dmaga_csr = esp->e_dmaga_csr = dmar->dmaga_csr | DMAGA_INTEN;
   1652 
   1653 	if (action & ESP_RESET_ESP) {
   1654 		/*
   1655 		 * according to Emulex, 2 NOPs with DMA are required here
   1656 		 * (essential for FAS101; id_code is unreliable if we don't
   1657 		 * do this)
   1658 		 */
   1659 		ESP_FLUSH_DMA(esp);
   1660 		Esp_cmd(esp, CMD_RESET_ESP);	/* hard-reset ESP chip */
   1661 		Esp_cmd(esp, CMD_NOP | CMD_DMA);
   1662 		Esp_cmd(esp, CMD_NOP | CMD_DMA);
   1663 
   1664 		/*
   1665 		 * Re-load chip configurations
   1666 		 */
   1667 		ep->esp_clock_conv = esp->e_clock_conv & CLOCK_MASK;
   1668 		ep->esp_timeout = esp->e_stval;
   1669 		ep->esp_sync_period = 0;
   1670 		ep->esp_sync_offset = 0;
   1671 
   1672 		/*
   1673 		 * enable default configurations
   1674 		 */
   1675 		if (esp->e_type == FAST) {
   1676 			uchar_t fcode;
   1677 
   1678 			esp->e_idcode = ep->esp_id_code;
   1679 			fcode =
   1680 			    (uchar_t)(ep->esp_id_code & ESP_FCODE_MASK)>>
   1681 			    (uchar_t)3;
   1682 			if (fcode == ESP_FAS236) {
   1683 				esp->e_type = FAS236;
   1684 			} else {
   1685 				esp->e_type = FAS100A;
   1686 			}
   1687 			IPRINTF2("Family code %d, revision %d\n",
   1688 			    fcode, (esp->e_idcode & ESP_REV_MASK));
   1689 		}
   1690 
   1691 		ep->esp_conf = esp->e_espconf;
   1692 		switch (esp->e_type) {
   1693 		case FAS236:
   1694 			/*
   1695 			 * used on DSBE, FSBE, galaxies
   1696 			 */
   1697 			IPRINTF("type is FAS236\n");
   1698 			for (i = 0; i < NTARGETS; i++) {
   1699 				esp->e_espconf3[i] |= ESP_CONF3_236_FASTCLK;
   1700 			}
   1701 			ep->esp_conf3 = esp->e_espconf3[0];
   1702 			esp->e_espconf3_fastscsi = ESP_CONF3_236_FASTSCSI;
   1703 			ep->esp_conf2 = esp->e_espconf2;
   1704 
   1705 			/*
   1706 			 * check if differential scsi bus; if so then no
   1707 			 * req/ack delay desired
   1708 			 */
   1709 			if (ddi_prop_get_int(DDI_DEV_T_ANY, esp->e_dev,
   1710 			    DDI_PROP_DONTPASS, "differential", 0)) {
   1711 				IPRINTF("differential scsibus\n");
   1712 				esp->e_req_ack_delay = 0;
   1713 				esp->e_options |= ESP_OPT_DIFFERENTIAL;
   1714 			} else {
   1715 				esp->e_req_ack_delay =
   1716 				    DEFAULT_REQ_ACK_DELAY_236;
   1717 			}
   1718 			if ((uchar_t)(ep->esp_id_code & ESP_REV_MASK)
   1719 			    > (uchar_t)2) {
   1720 				IPRINTF1("FAS236 rev=%x Stack_cmds DISABLED\n",
   1721 				    (uchar_t)(ep->esp_id_code & ESP_REV_MASK));
   1722 				esp->e_options |= ESP_OPT_DMA_OUT_TAG
   1723 				    | ESP_OPT_FAS;
   1724 			} else {
   1725 				IPRINTF1("FAS236 rev=%x Stack_cmds ENABLED\n",
   1726 				    (uchar_t)(ep->esp_id_code & ESP_REV_MASK));
   1727 				esp->e_options |= ESP_OPT_DMA_OUT_TAG
   1728 				    | ESP_OPT_FAS | ESP_OPT_STACKED_CMDS;
   1729 			}
   1730 			break;
   1731 
   1732 		case FAS100A:
   1733 			/*
   1734 			 * used on all desktop sun4m machines (macio)
   1735 			 */
   1736 			IPRINTF("type is FAS100A or 101A\n");
   1737 			for (i = 0; i < NTARGETS; i++) {
   1738 				esp->e_espconf3[i] |= ESP_CONF3_100A_FASTCLK;
   1739 			}
   1740 			ep->esp_conf3 = esp->e_espconf3[0];
   1741 			esp->e_espconf3_fastscsi = ESP_CONF3_100A_FASTSCSI;
   1742 			ep->esp_conf2 = esp->e_espconf2;
   1743 			esp->e_req_ack_delay = DEFAULT_REQ_ACK_DELAY_101;
   1744 			esp->e_options |= ESP_OPT_DMA_OUT_TAG | ESP_OPT_FAS |
   1745 			    ESP_OPT_ACCEPT_STEP567;
   1746 			break;
   1747 
   1748 		case ESP236:
   1749 			/*
   1750 			 * used on galaxies, SBE
   1751 			 */
   1752 			IPRINTF("type is ESP236\n");
   1753 			ep->esp_conf2 = esp->e_espconf2;
   1754 			ep->esp_conf3 = esp->e_espconf3[0];
   1755 			esp->e_options |= ESP_OPT_DMA_OUT_TAG |
   1756 			    ESP_OPT_SLOW_FIFO_FLUSH;
   1757 			break;
   1758 
   1759 		case ESP100A:
   1760 			/*
   1761 			 * used on SS2, IPX, sport8
   1762 			 */
   1763 			IPRINTF("type is ESP100A\n");
   1764 			ep->esp_conf2 = esp->e_espconf2;
   1765 			esp->e_options |= ESP_OPT_DMA_OUT_TAG |
   1766 			    ESP_OPT_MASK_OFF_STAT |
   1767 			    ESP_OPT_ACCEPT_STEP567;
   1768 			break;
   1769 
   1770 		case ESP100:
   1771 			/*
   1772 			 * used on SS1, SS1+, IPC
   1773 			 */
   1774 			IPRINTF("type is ESP100\n");
   1775 			IPRINTF("disable sync mode\n");
   1776 			esp->e_weak = 0xff;
   1777 			esp->e_options |= ESP_OPT_MASK_OFF_STAT;
   1778 			break;
   1779 
   1780 		default:
   1781 			IPRINTF("type is ???\n");
   1782 			break;
   1783 		}
   1784 
   1785 		/*
   1786 		 * look up esp-options property
   1787 		 */
   1788 		esp->e_options = ddi_prop_get_int(DDI_DEV_T_ANY,
   1789 		    esp->e_dev, 0, "esp-options", esp->e_options);
   1790 
   1791 		esplog(esp, CE_NOTE, "?esp-options=0x%x\n", esp->e_options);
   1792 
   1793 		/*
   1794 		 * Just in case...
   1795 		 * clear interrupt
   1796 		 */
   1797 		junk = ep->esp_intr;
   1798 
   1799 		IPRINTF1("clock conversion = %x\n", esp->e_clock_conv);
   1800 		IPRINTF2("conf = %x (%x)\n", esp->e_espconf, ep->esp_conf);
   1801 		if (esp->e_type > ESP100) {
   1802 			IPRINTF2("conf2 = %x (%x)\n",
   1803 			    esp->e_espconf2, ep->esp_conf2);
   1804 		}
   1805 		if (esp->e_type > ESP100A) {
   1806 			EPRINTF1("conf3=%x (read back)\n", ep->esp_conf3);
   1807 			EPRINTF4("conf3 (for target 0 - 3) = %x %x %x %x\n",
   1808 			    esp->e_espconf3[0], esp->e_espconf3[1],
   1809 			    esp->e_espconf3[2], esp->e_espconf3[3]);
   1810 			EPRINTF3("conf3 (for target 4 - 6) = %x %x %x\n",
   1811 			    esp->e_espconf3[4],
   1812 			    esp->e_espconf3[5], esp->e_espconf3[6]);
   1813 			EPRINTF2("req_ack_delay (0x%p) = %x\n",
   1814 			    (void *)&esp->e_req_ack_delay,
   1815 			    esp->e_req_ack_delay);
   1816 
   1817 		}
   1818 	}
   1819 
   1820 #ifdef	lint
   1821 	junk = junk;
   1822 #endif	/* lint */
   1823 }
   1824 
   1825 /*
   1826  * create a thread that performs the callbacks and init associated cv and mutex
   1827  *
   1828  * callback tunables:
   1829  */
   1830 static int esp_n_esps_per_callback_thread = 4;
   1831 static uchar_t esp_max_spawn = 2;	/* max of 2 extra threads for 4 esps */
   1832 static uchar_t esp_cb_now_qlen = 5;
   1833 static int esp_hi_cb_load = 50;		/* high watermark */
   1834 static int esp_lo_cb_load = 2;		/* low watermark */
   1835 static int esp_cb_load_count = 25;
   1836 
   1837 static int esp_n_callback_threads = 0;
   1838 static struct callback_info  *last_esp_callback_info;
   1839 
   1840 static void
   1841 esp_create_callback_thread(struct esp *esp)
   1842 {
   1843 	ASSERT(mutex_owned(&esp_global_mutex));
   1844 	ASSERT(esp->e_callback_info == NULL);
   1845 
   1846 	if ((esp_n_esps++ % esp_n_esps_per_callback_thread) == 0) {
   1847 		kthread_t *t;
   1848 		struct callback_info  *cb_info;
   1849 
   1850 		/*
   1851 		 * create another thread
   1852 		 */
   1853 		IPRINTF1("create callback thread %d\n", esp_n_callback_threads);
   1854 
   1855 		cb_info = kmem_zalloc(sizeof (struct callback_info), KM_SLEEP);
   1856 
   1857 		cv_init(&cb_info->c_cv, NULL, CV_DRIVER, NULL);
   1858 		cv_init(&cb_info->c_cvd, NULL, CV_DRIVER, NULL);
   1859 
   1860 		mutex_init(&cb_info->c_mutex, NULL, MUTEX_DRIVER,
   1861 		    esp->e_iblock);
   1862 
   1863 		cb_info->c_id = esp_n_callback_threads++;
   1864 		if (last_esp_callback_info) {
   1865 			last_esp_callback_info->c_next = cb_info;
   1866 		}
   1867 		last_esp_callback_info = esp->e_callback_info = cb_info;
   1868 
   1869 		t = thread_create(NULL, 0, esp_callback, esp, 0, &p0,
   1870 		    TS_RUN, v.v_maxsyspri - 2);
   1871 
   1872 		cb_info->c_thread = t;
   1873 		cb_info->c_spawned = esp_max_spawn;
   1874 		cb_info->c_cb_now_qlen = esp_cb_now_qlen;
   1875 	} else {
   1876 		ASSERT(last_esp_callback_info != NULL);
   1877 		IPRINTF1("sharing callback thread %d\n",
   1878 		    last_esp_callback_info->c_id);
   1879 		esp->e_callback_info = last_esp_callback_info;
   1880 	}
   1881 }
   1882 
   1883 static void
   1884 esp_destroy_callback_thread(struct esp *esp)
   1885 {
   1886 	struct esp	*e;
   1887 
   1888 	ASSERT(esp->e_callback_info != NULL);
   1889 
   1890 	/*
   1891 	 * Remove callback
   1892 	 *
   1893 	 * We have to see if we are the last one using this cb thread
   1894 	 * before deleting it.
   1895 	 * Check the list for others referencing this cb.  We are off
   1896 	 * the list, so finding one other reference indicates shared.
   1897 	 */
   1898 	rw_enter(&esp_global_rwlock, RW_READER);
   1899 	for (e = esp_softc; e != (struct esp *)NULL; e = e->e_next) {
   1900 		if (e->e_callback_info == esp->e_callback_info) {
   1901 			break;
   1902 		}
   1903 	}
   1904 	rw_exit(&esp_global_rwlock);
   1905 
   1906 	/*
   1907 	 * we couldn't find another esp sharing this cb
   1908 	 */
   1909 	if (!e) {
   1910 		struct callback_info	*ci = esp->e_callback_info;
   1911 		struct callback_info	*tci, **pci;
   1912 
   1913 	IPRINTF2("esp_destroy_callback_thread: "
   1914 	    "killing callback 0x%p thread %d\n",
   1915 	    (void *)esp->e_callback_info, ci->c_id);
   1916 		mutex_enter(&ci->c_mutex);
   1917 		ci->c_exit = 1;			/* die */
   1918 
   1919 		IPRINTF2("esp_destroy_callback_thread: spawned %d max %d\n",
   1920 		    ci->c_spawned, esp_max_spawn);
   1921 		while (ci->c_spawned <= (uchar_t)esp_max_spawn) {
   1922 			IPRINTF1("esp_destroy_callback_thread:%p wakeup\n",
   1923 			    (void *)ci);
   1924 			cv_broadcast(&ci->c_cv);	/* might be snoozing */
   1925 			cv_wait(&ci->c_cvd, &ci->c_mutex);
   1926 		}
   1927 
   1928 		mutex_exit(&ci->c_mutex);
   1929 		IPRINTF("esp_destroy_callback_thread: all threads killed\n");
   1930 
   1931 		mutex_enter(&esp_global_mutex);
   1932 		for (pci = &last_esp_callback_info;
   1933 		    (tci = *pci) != NULL; pci = &tci->c_next) {
   1934 			if (tci == ci) {
   1935 				/* take it out of list */
   1936 				*pci = tci->c_next;
   1937 				/* destroy it */
   1938 				cv_destroy(&ci->c_cv);
   1939 				cv_destroy(&ci->c_cvd);
   1940 				mutex_destroy(&ci->c_mutex);
   1941 				kmem_free(ci, sizeof (struct callback_info));
   1942 				IPRINTF1("esp_destroy_callback_thread:%p"
   1943 				    " freed\n", (void *)ci);
   1944 				esp->e_callback_info = NULL;
   1945 				break;
   1946 			}
   1947 		}
   1948 	} else {
   1949 		mutex_enter(&esp_global_mutex);
   1950 		IPRINTF1("esp_destroy_callback_thread: callback 0x%p shared\n",
   1951 		    (void *)esp->e_callback_info);
   1952 	}
   1953 
   1954 	esp_n_esps--;
   1955 	mutex_exit(&esp_global_mutex);
   1956 }
   1957 
   1958 /*
   1959  * this is the function executed by the callback thread; it
   1960  * empties the callback queue by calling the completion function of each
   1961  * packet; note the release of the mutex before
   1962  * calling the completion function
   1963  * the cv_wait is at the end of the loop because by the time this thread
   1964  * comes alive, there is already work to do.
   1965  */
   1966 void
   1967 esp_wakeup_callback_thread(struct callback_info *cb_info)
   1968 {
   1969 	struct esp_cmd *sp;
   1970 
   1971 	mutex_enter(&cb_info->c_mutex);
   1972 	if (cb_info->c_qlen) {
   1973 		/*
   1974 		 * callback now?
   1975 		 */
   1976 		if ((cb_info->c_qlen < cb_info->c_cb_now_qlen) || panicstr) {
   1977 			while (cb_info->c_qf) {
   1978 				sp = cb_info->c_qf;
   1979 				cb_info->c_qf = sp->cmd_forw;
   1980 				if (cb_info->c_qb == sp) {
   1981 					cb_info->c_qb = NULL;
   1982 				}
   1983 				cb_info->c_qlen--;
   1984 				mutex_exit(&cb_info->c_mutex);
   1985 				(*sp->cmd_pkt.pkt_comp)(&sp->cmd_pkt);
   1986 				mutex_enter(&cb_info->c_mutex);
   1987 			}
   1988 		/*
   1989 		 * if the queue is too long then do
   1990 		 * a wakeup for *all* callback threads
   1991 		 */
   1992 		} else if (cb_info->c_signal_needed) {
   1993 			cv_broadcast(&cb_info->c_cv);
   1994 		}
   1995 	}
   1996 	cb_info->c_signal_needed = 0;
   1997 	mutex_exit(&cb_info->c_mutex);
   1998 }
   1999 
   2000 /*
   2001  * Warlock has a problem when we use different locks
   2002  * on the same type of structure in different contexts.
   2003  * We use callb_cpr_t in both scsi_watch and esp_callback threads.
   2004  * we use different mutex's in different threads. And
   2005  * this is not acceptable to warlock. To avoid this
   2006  * problem we use the same name for the mutex in
   2007  * both scsi_watch & esp_callback. when __lock_lint is not defined
   2008  * esp_callback uses the mutex on the stack and in scsi_watch
   2009  * a static variable. But when __lock_lint is defined
   2010  * we make a mutex which is global in esp_callback and
   2011  * a external mutex for scsi_watch.
   2012  */
   2013 #ifdef __lock_lint
   2014 kmutex_t cpr_mutex;
   2015 #endif
   2016 
   2017 static void
   2018 esp_callback(struct esp *esp)
   2019 {
   2020 	struct esp_cmd *sp;
   2021 	struct callback_info *cb_info = esp->e_callback_info;
   2022 	int serviced = 0;
   2023 	int wakeups = 0;
   2024 	int id, load;
   2025 	int hiload = 0;
   2026 	int loload = 0;
   2027 	callb_cpr_t cpr_info;
   2028 #ifndef	__lock_lint
   2029 	kmutex_t cpr_mutex;
   2030 #endif
   2031 	int n = 0;
   2032 
   2033 	_NOTE(MUTEX_PROTECTS_DATA(cpr_mutex, cpr_info))
   2034 	_NOTE(NO_COMPETING_THREADS_NOW);
   2035 	mutex_init(&cpr_mutex, NULL, MUTEX_DRIVER, esp->e_iblock);
   2036 	CALLB_CPR_INIT(&cpr_info,
   2037 	    &cpr_mutex, callb_generic_cpr, "esp_callback");
   2038 #ifndef lint
   2039 	_NOTE(COMPETING_THREADS_NOW);
   2040 #endif
   2041 
   2042 	mutex_enter(&cb_info->c_mutex);
   2043 
   2044 	id = cb_info->c_count++;
   2045 #ifdef ESP_PERF
   2046 	cmn_err(CE_CONT,
   2047 	    "esp cb%d.%d thread starting\n", cb_info->c_id, id);
   2048 #endif
   2049 
   2050 	for (;;) {
   2051 		TRACE_0(TR_FAC_SCSI, TR_ESP_CALLBACK_START,
   2052 		    "esp_callback_start");
   2053 		while (cb_info->c_qf) {
   2054 			sp = cb_info->c_qf;
   2055 			cb_info->c_qf = sp->cmd_forw;
   2056 			if (cb_info->c_qb == sp) {
   2057 				cb_info->c_qb = NULL;
   2058 			}
   2059 			cb_info->c_qlen--;
   2060 			ASSERT(sp->cmd_pkt.pkt_comp != 0);
   2061 			serviced++;
   2062 			mutex_exit(&cb_info->c_mutex);
   2063 			(*sp->cmd_pkt.pkt_comp)(&sp->cmd_pkt);
   2064 			mutex_enter(&cb_info->c_mutex);
   2065 			n++;
   2066 		}
   2067 
   2068 		/*
   2069 		 * check load
   2070 		 * if the load is consistently too high, create another
   2071 		 * thread to help out
   2072 		 * if the load is consistently too low, exit thread
   2073 		 * If the load is so high that we never exit the
   2074 		 * above while loop then esp_n_esps_per_callback_thread is
   2075 		 * too high; we are not going to deal with that condition
   2076 		 * here
   2077 		 */
   2078 		if (wakeups) {
   2079 			load  = (serviced + wakeups - 1)/wakeups;
   2080 		} else {
   2081 			load = 0;
   2082 		}
   2083 
   2084 		if (cb_info->c_exit) {
   2085 			EPRINTF2("esp_callback: thread %d 0x%p exit set\n",
   2086 			    cb_info->c_id, (void *)cb_info);
   2087 			cb_info->c_spawned++;
   2088 			cv_broadcast(&cb_info->c_cvd);
   2089 			mutex_exit(&cb_info->c_mutex);
   2090 			break;
   2091 		} else if (load > esp_hi_cb_load) {
   2092 			/*
   2093 			 * load is too high
   2094 			 */
   2095 			if ((hiload++ > esp_cb_load_count) &&
   2096 			    (cb_info->c_spawned > 0)) {
   2097 				/*
   2098 				 * create another thread
   2099 				 */
   2100 				(void) thread_create(NULL, 0, esp_callback, esp,
   2101 				    0, &p0, TS_RUN, v.v_maxsyspri - 2);
   2102 				serviced = wakeups = 0;
   2103 				cb_info->c_spawned--;
   2104 				/*
   2105 				 * from now on do not allow immediate
   2106 				 * callback
   2107 				 */
   2108 				cb_info->c_cb_now_qlen = 0;
   2109 				hiload = loload = 0;
   2110 			}
   2111 		} else if (load < esp_lo_cb_load) {
   2112 			/*
   2113 			 * load is too low
   2114 			 */
   2115 			if (loload++ > esp_cb_load_count) {
   2116 				/*
   2117 				 * if this is not the first thread, exit
   2118 				 */
   2119 				if (id != 0) {
   2120 					cb_info->c_spawned++;
   2121 					mutex_exit(&cb_info->c_mutex);
   2122 					/*
   2123 					 * exit while loop and esp_callback
   2124 					 * function which destroys the
   2125 					 * thread
   2126 					 */
   2127 					break;
   2128 				} else {
   2129 					/*
   2130 					 * if only 1 thread left then set
   2131 					 * back cb_now_qlen
   2132 					 */
   2133 					if (cb_info->c_spawned ==
   2134 					    esp_max_spawn) {
   2135 						cb_info->c_cb_now_qlen =
   2136 						    esp_cb_now_qlen;
   2137 					}
   2138 				}
   2139 				hiload = loload = 0;
   2140 			}
   2141 		} else {
   2142 			/*
   2143 			 * always use deferred callback from now on
   2144 			 */
   2145 			cb_info->c_cb_now_qlen = 0;
   2146 			hiload = loload = 0;
   2147 		}
   2148 
   2149 		TRACE_1(TR_FAC_SCSI, TR_ESP_CALLBACK_END,
   2150 		    "esp_callback_end: (%d)", serviced);
   2151 
   2152 		/*
   2153 		 * reset serviced and wakeups; if these numbers get too high
   2154 		 * then we don't adjust to bursts very well
   2155 		 */
   2156 		if (serviced >= 20000) {
   2157 #ifdef ESP_PERF
   2158 			cmn_err(CE_CONT,
   2159 	    "esp cb%d.%d: svced=%d, wkup=%d, ld=%d, spwn=%d, now_qlen=%d\n",
   2160 			    cb_info->c_id, id, serviced, wakeups,
   2161 			    load, cb_info->c_spawned,
   2162 			    cb_info->c_cb_now_qlen);
   2163 #endif
   2164 			serviced = 0;
   2165 			wakeups = 0;
   2166 		}
   2167 
   2168 		mutex_enter(&cpr_mutex);
   2169 		CALLB_CPR_SAFE_BEGIN(&cpr_info);
   2170 		mutex_exit(&cpr_mutex);
   2171 
   2172 		cv_wait(&cb_info->c_cv, &cb_info->c_mutex);
   2173 
   2174 		mutex_exit(&cb_info->c_mutex);
   2175 		mutex_enter(&cpr_mutex);
   2176 		CALLB_CPR_SAFE_END(&cpr_info, &cpr_mutex);
   2177 		mutex_exit(&cpr_mutex);
   2178 		mutex_enter(&cb_info->c_mutex);
   2179 
   2180 		cb_info->c_signal_needed = 0;
   2181 		wakeups++;
   2182 	}
   2183 
   2184 #ifdef ESP_PERF
   2185 	cmn_err(CE_CONT, "esp cb%d.%d exits\n", cb_info->c_id, id);
   2186 #endif
   2187 	TRACE_1(TR_FAC_SCSI, TR_ESP_CALLBACK_END,
   2188 	    "esp_callback_end:  (%d)", n);
   2189 #ifndef __lock_lint
   2190 	mutex_enter(&cpr_mutex);
   2191 	CALLB_CPR_EXIT(&cpr_info);
   2192 #endif
   2193 	mutex_destroy(&cpr_mutex);
   2194 	thread_exit();
   2195 }
   2196 
   2197 /*
   2198  * Interface functions
   2199  *
   2200  * Visible to the external world via the transport structure.
   2201  *
   2202  * These functions have been grouped together to reduce cache misses.
   2203  *
   2204  */
   2205 /*ARGSUSED*/
   2206 static void
   2207 esp_scsi_dmafree(struct scsi_address *ap, struct scsi_pkt *pkt)
   2208 {
   2209 	struct esp_cmd *cmd = (struct esp_cmd *)pkt->pkt_ha_private;
   2210 
   2211 	TRACE_0(TR_FAC_SCSI, TR_ESP_SCSI_IMPL_DMAFREE_START,
   2212 	    "esp_scsi_dmafree_start");
   2213 
   2214 	if (cmd->cmd_flags & CFLAG_DMAVALID) {
   2215 		/*
   2216 		 * Free the mapping.
   2217 		 */
   2218 		(void) ddi_dma_unbind_handle(cmd->cmd_dmahandle);
   2219 		cmd->cmd_flags ^= CFLAG_DMAVALID;
   2220 	}
   2221 	TRACE_0(TR_FAC_SCSI, TR_ESP_SCSI_IMPL_DMAFREE_END,
   2222 	    "esp_scsi_dmafree_end");
   2223 }
   2224 
   2225 
   2226 /*ARGSUSED*/
   2227 static void
   2228 esp_scsi_sync_pkt(struct scsi_address *ap, struct scsi_pkt *pkt)
   2229 {
   2230 	int i;
   2231 	struct esp_cmd *sp = (struct esp_cmd *)pkt->pkt_ha_private;
   2232 
   2233 	if (sp->cmd_flags & CFLAG_DMAVALID) {
   2234 		i = ddi_dma_sync(sp->cmd_dmahandle, 0, 0,
   2235 		    (sp->cmd_flags & CFLAG_DMASEND) ?
   2236 		    DDI_DMA_SYNC_FORDEV : DDI_DMA_SYNC_FORCPU);
   2237 		if (i != DDI_SUCCESS) {
   2238 			cmn_err(CE_WARN, "esp: sync pkt failed");
   2239 		}
   2240 	}
   2241 }
   2242 
   2243 
   2244 static struct scsi_pkt *
   2245 esp_scsi_init_pkt(struct scsi_address *ap, struct scsi_pkt *pkt,
   2246 	struct buf *bp, int cmdlen, int statuslen, int tgtlen,
   2247 	int flags, int (*callback)(), caddr_t arg)
   2248 {
   2249 	int kf;
   2250 	int failure = 0;
   2251 	struct esp_cmd *cmd, *new_cmd;
   2252 	struct esp *esp = ADDR2ESP(ap);
   2253 	int rval;
   2254 
   2255 /* #define	ESP_TEST_EXTRN_ALLOC */
   2256 #ifdef ESP_TEST_EXTRN_ALLOC
   2257 	cmdlen *= 4; statuslen *= 4; tgtlen *= 4;
   2258 #endif
   2259 	/*
   2260 	 * If we've already allocated a pkt once,
   2261 	 * this request is for dma allocation only.
   2262 	 */
   2263 	if (pkt == NULL) {
   2264 		/*
   2265 		 * First step of esp_scsi_init_pkt:  pkt allocation
   2266 		 */
   2267 		TRACE_0(TR_FAC_SCSI, TR_ESP_SCSI_IMPL_PKTALLOC_START,
   2268 		    "esp_scsi_pktalloc_start");
   2269 
   2270 		failure = 0;
   2271 		kf = (callback == SLEEP_FUNC)? KM_SLEEP: KM_NOSLEEP;
   2272 
   2273 		cmd = kmem_cache_alloc(esp->e_kmem_cache, kf);
   2274 
   2275 		if (cmd) {
   2276 			ddi_dma_handle_t save_dma_handle;
   2277 
   2278 			save_dma_handle = cmd->cmd_dmahandle;
   2279 			bzero(cmd, ESP_CMD_SIZE);
   2280 			cmd->cmd_dmahandle = save_dma_handle;
   2281 
   2282 			cmd->cmd_pkt.pkt_scbp = (opaque_t)cmd->cmd_scb;
   2283 			cmd->cmd_cdblen_alloc = cmd->cmd_cdblen =
   2284 			    (uchar_t)cmdlen;
   2285 			cmd->cmd_scblen		= statuslen;
   2286 			cmd->cmd_privlen	= tgtlen;
   2287 			cmd->cmd_pkt.pkt_address = *ap;
   2288 
   2289 			cmd->cmd_pkt.pkt_cdbp = (opaque_t)&cmd->cmd_cdb;
   2290 			cmd->cmd_pkt.pkt_private = cmd->cmd_pkt_private;
   2291 			cmd->cmd_pkt.pkt_ha_private = (opaque_t)cmd;
   2292 		} else {
   2293 			failure++;
   2294 		}
   2295 
   2296 		if (failure || (cmdlen > sizeof (cmd->cmd_cdb)) ||
   2297 		    (tgtlen > PKT_PRIV_LEN) ||
   2298 		    (statuslen > EXTCMDS_STATUS_SIZE)) {
   2299 			if (failure == 0) {
   2300 				failure = esp_pkt_alloc_extern(esp, cmd,
   2301 				    cmdlen, tgtlen, statuslen, kf);
   2302 			}
   2303 			if (failure) {
   2304 				TRACE_0(TR_FAC_SCSI,
   2305 				    TR_ESP_SCSI_IMPL_PKTALLOC_END,
   2306 				    "esp_scsi_pktalloc_end");
   2307 				return (NULL);
   2308 			}
   2309 		}
   2310 
   2311 		new_cmd = cmd;
   2312 
   2313 		TRACE_0(TR_FAC_SCSI, TR_ESP_SCSI_IMPL_PKTALLOC_END,
   2314 		    "esp_scsi_pktalloc_end");
   2315 	} else {
   2316 		cmd = (struct esp_cmd *)pkt->pkt_ha_private;
   2317 		new_cmd = NULL;
   2318 	}
   2319 
   2320 
   2321 	/*
   2322 	 * Second step of esp_scsi_init_pkt:  dma allocation
   2323 	 * Set up dma info
   2324 	 */
   2325 	if (bp && bp->b_bcount) {
   2326 		uint_t cmd_flags, dma_flags;
   2327 		uint_t dmacookie_count;
   2328 
   2329 		TRACE_0(TR_FAC_SCSI, TR_SCSI_IMPL_DMAGET_START,
   2330 		    "esp_scsi_dmaget_start");
   2331 
   2332 		cmd_flags = cmd->cmd_flags;
   2333 
   2334 		if (bp->b_flags & B_READ) {
   2335 			cmd_flags &= ~CFLAG_DMASEND;
   2336 			dma_flags = DDI_DMA_READ | DDI_DMA_PARTIAL;
   2337 		} else {
   2338 			cmd_flags |= CFLAG_DMASEND;
   2339 			dma_flags = DDI_DMA_WRITE | DDI_DMA_PARTIAL;
   2340 		}
   2341 		if (flags & PKT_CONSISTENT) {
   2342 			cmd_flags |= CFLAG_CMDIOPB;
   2343 			dma_flags |= DDI_DMA_CONSISTENT;
   2344 		}
   2345 
   2346 		ASSERT(cmd->cmd_dmahandle != NULL);
   2347 
   2348 		rval = ddi_dma_buf_bind_handle(cmd->cmd_dmahandle, bp,
   2349 		    dma_flags, callback, arg, &cmd->cmd_dmacookie,
   2350 		    &dmacookie_count);
   2351 dma_failure:
   2352 		if (rval && rval != DDI_DMA_PARTIAL_MAP) {
   2353 			switch (rval) {
   2354 			case DDI_DMA_NORESOURCES:
   2355 				bioerror(bp, 0);
   2356 				break;
   2357 			case DDI_DMA_BADATTR:
   2358 			case DDI_DMA_NOMAPPING:
   2359 				bioerror(bp, EFAULT);
   2360 				break;
   2361 			case DDI_DMA_TOOBIG:
   2362 			default:
   2363 				bioerror(bp, EINVAL);
   2364 				break;
   2365 			}
   2366 			cmd->cmd_flags = cmd_flags & ~CFLAG_DMAVALID;
   2367 			if (new_cmd) {
   2368 				esp_scsi_destroy_pkt(ap, &new_cmd->cmd_pkt);
   2369 			}
   2370 			TRACE_0(TR_FAC_SCSI, TR_SCSI_IMPL_DMAGET_END,
   2371 			    "esp_scsi_dmaget_end");
   2372 			return ((struct scsi_pkt *)NULL);
   2373 		}
   2374 		ASSERT(dmacookie_count == 1);
   2375 		cmd->cmd_dmacount = bp->b_bcount;
   2376 		cmd->cmd_flags = cmd_flags | CFLAG_DMAVALID;
   2377 
   2378 		ASSERT(cmd->cmd_dmahandle != NULL);
   2379 		TRACE_0(TR_FAC_SCSI, TR_SCSI_IMPL_DMAGET_END,
   2380 		    "esp_scsi_dmaget_end");
   2381 	}
   2382 
   2383 	return (&cmd->cmd_pkt);
   2384 }
   2385 
   2386 /*
   2387  * allocate and deallocate external space (ie. not part of esp_cmd) for
   2388  * non-standard length cdb, pkt_private, status areas
   2389  */
   2390 /* ARGSUSED */
   2391 static int
   2392 esp_pkt_alloc_extern(struct esp *esp, struct esp_cmd *sp,
   2393     int cmdlen, int tgtlen, int statuslen, int kf)
   2394 {
   2395 	caddr_t cdbp, scbp, tgt;
   2396 	int failure = 0;
   2397 
   2398 	tgt = cdbp = scbp = NULL;
   2399 	if (cmdlen > sizeof (sp->cmd_cdb)) {
   2400 		if ((cdbp = kmem_zalloc((size_t)cmdlen, kf)) == NULL) {
   2401 			failure++;
   2402 		} else {
   2403 			sp->cmd_pkt.pkt_cdbp = (opaque_t)cdbp;
   2404 			sp->cmd_flags |= CFLAG_CDBEXTERN;
   2405 		}
   2406 	}
   2407 	if (tgtlen > PKT_PRIV_LEN) {
   2408 		if ((tgt = kmem_zalloc(tgtlen, kf)) == NULL) {
   2409 			failure++;
   2410 		} else {
   2411 			sp->cmd_flags |= CFLAG_PRIVEXTERN;
   2412 			sp->cmd_pkt.pkt_private = tgt;
   2413 		}
   2414 	}
   2415 	if (statuslen > EXTCMDS_STATUS_SIZE) {
   2416 		if ((scbp = kmem_zalloc((size_t)statuslen, kf)) == NULL) {
   2417 			failure++;
   2418 		} else {
   2419 			sp->cmd_flags |= CFLAG_SCBEXTERN;
   2420 			sp->cmd_pkt.pkt_scbp = (opaque_t)scbp;
   2421 		}
   2422 	}
   2423 	if (failure) {
   2424 		esp_pkt_destroy_extern(esp, sp);
   2425 	}
   2426 	return (failure);
   2427 }
   2428 
   2429 /* ARGSUSED */
   2430 static void
   2431 esp_scsi_destroy_pkt(struct scsi_address *ap, struct scsi_pkt *pkt)
   2432 {
   2433 	struct esp_cmd *sp = (struct esp_cmd *)pkt->pkt_ha_private;
   2434 	struct esp *esp = ADDR2ESP(ap);
   2435 
   2436 	/*
   2437 	 * esp_scsi_dmafree inline to speed things up
   2438 	 */
   2439 	TRACE_0(TR_FAC_SCSI, TR_ESP_SCSI_IMPL_DMAFREE_START,
   2440 	    "esp_scsi_dmafree_start");
   2441 
   2442 	if (sp->cmd_flags & CFLAG_DMAVALID) {
   2443 		/*
   2444 		 * Free the mapping.
   2445 		 */
   2446 		(void) ddi_dma_unbind_handle(sp->cmd_dmahandle);
   2447 		sp->cmd_flags ^= CFLAG_DMAVALID;
   2448 	}
   2449 	TRACE_0(TR_FAC_SCSI, TR_ESP_SCSI_IMPL_DMAFREE_END,
   2450 	    "esp_scsi_dmafree_end");
   2451 
   2452 	TRACE_0(TR_FAC_SCSI, TR_ESP_SCSI_IMPL_PKTFREE_START,
   2453 	    "esp_scsi_pktfree_start");
   2454 
   2455 	/*
   2456 	 * first test the most common case
   2457 	 */
   2458 	if ((sp->cmd_flags &
   2459 	    (CFLAG_FREE | CFLAG_CDBEXTERN | CFLAG_PRIVEXTERN |
   2460 	    CFLAG_SCBEXTERN)) == 0) {
   2461 		sp->cmd_flags = CFLAG_FREE;
   2462 		kmem_cache_free(esp->e_kmem_cache, (void *)sp);
   2463 	} else {
   2464 		esp_pkt_destroy_extern(esp, sp);
   2465 	}
   2466 
   2467 	TRACE_0(TR_FAC_SCSI, TR_ESP_SCSI_IMPL_PKTFREE_END,
   2468 	    "esp_scsi_pktfree_end");
   2469 }
   2470 
   2471 /* ARGSUSED */
   2472 static void
   2473 esp_pkt_destroy_extern(struct esp *esp, struct esp_cmd *sp)
   2474 {
   2475 	if (sp->cmd_flags & CFLAG_FREE) {
   2476 		panic("esp_pkt_destroy(_extern): freeing free packet");
   2477 		_NOTE(NOT_REACHED)
   2478 		/*NOTREACHED*/
   2479 	}
   2480 	if (sp->cmd_flags & CFLAG_CDBEXTERN) {
   2481 		kmem_free((caddr_t)sp->cmd_pkt.pkt_cdbp,
   2482 		    (size_t)sp->cmd_cdblen_alloc);
   2483 	}
   2484 	if (sp->cmd_flags & CFLAG_SCBEXTERN) {
   2485 		kmem_free((caddr_t)sp->cmd_pkt.pkt_scbp,
   2486 		    (size_t)sp->cmd_scblen);
   2487 	}
   2488 	if (sp->cmd_flags & CFLAG_PRIVEXTERN) {
   2489 		kmem_free((caddr_t)sp->cmd_pkt.pkt_private,
   2490 		    (size_t)sp->cmd_privlen);
   2491 	}
   2492 	sp->cmd_flags = CFLAG_FREE;
   2493 	kmem_cache_free(esp->e_kmem_cache, (void *)sp);
   2494 }
   2495 
   2496 /*
   2497  * kmem cache constructor and destructor.
   2498  * When constructing, we bzero the cmd and allocate a handle
   2499  * When destructing, just free the dma handle
   2500  */
   2501 static int
   2502 esp_kmem_cache_constructor(void *buf, void *cdrarg, int kmflags)
   2503 {
   2504 	struct esp_cmd *cmd = buf;
   2505 	struct esp *esp = cdrarg;
   2506 	int  (*callback)(caddr_t) = (kmflags == KM_SLEEP) ? DDI_DMA_SLEEP:
   2507 	    DDI_DMA_DONTWAIT;
   2508 
   2509 	bzero(cmd, ESP_CMD_SIZE);
   2510 
   2511 	if (ddi_dma_alloc_handle(esp->e_dev,
   2512 	    esp->e_dma_attr, callback, NULL,
   2513 	    &cmd->cmd_dmahandle) != 0) {
   2514 		return (-1);
   2515 	}
   2516 	return (0);
   2517 }
   2518 
   2519 /* ARGSUSED */
   2520 static void
   2521 esp_kmem_cache_destructor(void *buf, void *cdrarg)
   2522 {
   2523 	struct esp_cmd *cmd = buf;
   2524 	if (cmd->cmd_dmahandle) {
   2525 		ddi_dma_free_handle(&cmd->cmd_dmahandle);
   2526 	}
   2527 }
   2528 
   2529 /*
   2530  * esp_prepare_pkt():
   2531  * initialize the packet and do some sanity checks
   2532  * before taking the lock
   2533  */
   2534 static int
   2535 esp_prepare_pkt(struct esp *esp, struct esp_cmd *sp)
   2536 {
   2537 	int size, cmdlen;
   2538 
   2539 #ifdef ESPDEBUG
   2540 	if (sp->cmd_flags & CFLAG_DMAVALID) {
   2541 		uint32_t maxdma;
   2542 		switch (ESP_DMAGA_REV(esp)) {
   2543 		default:
   2544 		case DMA_REV1:
   2545 		case DMA_REV2:
   2546 		case ESC1_REV1:
   2547 			maxdma = 1 << 24;
   2548 			break;
   2549 		case DMA_REV3:
   2550 			maxdma = 1 << 30; /* be reasonable - 2gb is enuff */
   2551 			break;
   2552 		}
   2553 		if (sp->cmd_dmacount >= maxdma) {
   2554 			IPRINTF("prepare pkt: dma count too high\n");
   2555 			return (TRAN_BADPKT);
   2556 		}
   2557 	}
   2558 	ASSERT((sp->cmd_flags & CFLAG_IN_TRANSPORT) == 0);
   2559 #endif
   2560 
   2561 	/*
   2562 	 * Reinitialize some fields that need it; the packet may
   2563 	 * have been resubmitted
   2564 	 */
   2565 	sp->cmd_pkt.pkt_reason = CMD_CMPLT;
   2566 	sp->cmd_pkt.pkt_state = 0;
   2567 	sp->cmd_pkt.pkt_statistics = 0;
   2568 	sp->cmd_pkt.pkt_resid = 0;
   2569 	sp->cmd_age = 0;
   2570 
   2571 	/*
   2572 	 * Copy the cdb and scb pointers to the esp_cmd area as we
   2573 	 * modify these parameters.
   2574 	 */
   2575 	sp->cmd_cdbp = sp->cmd_pkt.pkt_cdbp;
   2576 	sp->cmd_scbp = sp->cmd_pkt.pkt_scbp;
   2577 	*(sp->cmd_scbp) = 0;
   2578 	sp->cmd_flags &= ~CFLAG_TRANFLAG;
   2579 	sp->cmd_flags |= CFLAG_IN_TRANSPORT;
   2580 
   2581 	if (sp->cmd_pkt.pkt_time != 0) {
   2582 		sp->cmd_flags |= CFLAG_WATCH;
   2583 	}
   2584 	sp->cmd_timeout = sp->cmd_pkt.pkt_time; /* Set timeout */
   2585 
   2586 	if (sp->cmd_flags & CFLAG_DMAVALID) {
   2587 		sp->cmd_pkt.pkt_resid = sp->cmd_dmacount;
   2588 
   2589 		/*
   2590 		 * if the pkt was resubmitted then the
   2591 		 * window may be at the wrong number
   2592 		 */
   2593 		if (sp->cmd_cur_win) {
   2594 			sp->cmd_cur_win = 0;
   2595 			if (esp_set_new_window(esp, sp)) {
   2596 				IPRINTF("cannot reset window\n");
   2597 				return (TRAN_BADPKT);
   2598 			}
   2599 		}
   2600 		sp->cmd_saved_cur_addr =
   2601 		    sp->cmd_cur_addr = sp->cmd_dmacookie.dmac_address;
   2602 
   2603 		/*
   2604 		 * the common case is just one window, we worry
   2605 		 * about multiple windows when we run out of the
   2606 		 * current window
   2607 		 */
   2608 		sp->cmd_nwin = sp->cmd_saved_win = 0;
   2609 		sp->cmd_data_count = sp->cmd_saved_data_count = 0;
   2610 
   2611 		if ((sp->cmd_flags & (CFLAG_CMDIOPB | CFLAG_DMASEND)) ==
   2612 		    (CFLAG_CMDIOPB | CFLAG_DMASEND)) {
   2613 			(void) ddi_dma_sync(sp->cmd_dmahandle, 0, (uint_t)-1,
   2614 			    DDI_DMA_SYNC_FORDEV);
   2615 		}
   2616 	}
   2617 
   2618 	/*
   2619 	 * The ESP chip only will automatically send 6, 10 or 12 byte
   2620 	 * cdb's.  Setting cmd_cdblen to a non-zero value signals this.
   2621 	 * Otherwise, we have to do it manually and send them out one at
   2622 	 * a time.  Setting cmd_cdblen to zero signals this condition.
   2623 	 * For non-group{0,1,2,5} cmds we use the cmdlen specified by
   2624 	 * the target driver if it is 6, 10, or 12.
   2625 	 */
   2626 	size = scsi_cdb_size[CDB_GROUPID(sp->cmd_cdbp[0])];
   2627 	cmdlen = sp->cmd_cdblen;
   2628 	if (size == 0 && (cmdlen != CDB_GROUP0 &&
   2629 	    cmdlen != CDB_GROUP1 && cmdlen != CDB_GROUP5)) {
   2630 		sp->cmd_cdblen = 0;
   2631 		IPRINTF("cdblen = 0\n");
   2632 	} else if (size != 0) {
   2633 		sp->cmd_cdblen = (uchar_t)size;
   2634 	}
   2635 
   2636 
   2637 #ifdef ESP_TEST_UNTAGGED
   2638 #ifndef __lock_lint
   2639 	if (esp_test_untagged > 0) {
   2640 		if (TAGGED(Tgt(sp))) {
   2641 			int slot = Tgt(sp) * NLUNS_PER_TARGET | Lun(sp);
   2642 			sp->cmd_pkt.pkt_flags &= ~FLAG_TAGMASK;
   2643 			sp->cmd_pkt.pkt_flags &= ~FLAG_NODISCON;
   2644 			sp->cmd_pkt.pkt_flags |= 0x80000000;
   2645 			esplog(esp, CE_NOTE,
   2646 			    "starting untagged cmd, target=%d,"
   2647 			    " tcmds=%d, sp=0x%p, throttle=%d\n",
   2648 			    Tgt(sp), esp->e_tcmds[slot], (void *)sp,
   2649 			    esp->e_throttle[slot]);
   2650 			esp_test_untagged = -10;
   2651 		}
   2652 	}
   2653 #endif
   2654 #endif
   2655 
   2656 
   2657 #ifdef ESPDEBUG
   2658 	if (NOTAG(Tgt(sp)) && (sp->cmd_pkt.pkt_flags & FLAG_TAGMASK)) {
   2659 		IPRINTF2("tagged packet for non-tagged target %d.%d\n",
   2660 		    Tgt(sp), Lun(sp));
   2661 		sp->cmd_pkt.pkt_flags &= ~FLAG_TAGMASK;
   2662 	}
   2663 
   2664 	/*
   2665 	 * the scsa spec states that it is an error to have no
   2666 	 * completion function when FLAG_NOINTR is not set
   2667 	 */
   2668 	if ((sp->cmd_pkt.pkt_comp == NULL) &&
   2669 	    ((sp->cmd_pkt.pkt_flags & FLAG_NOINTR) == 0)) {
   2670 		IPRINTF("intr packet with pkt_comp == 0\n");
   2671 		sp->cmd_flags &= ~CFLAG_IN_TRANSPORT;
   2672 		TRACE_0(TR_FAC_SCSI, TR_ESP_PREPARE_PKT_TRAN_BADPKT_END,
   2673 		    "esp_prepare_pkt_end (tran_badpkt)");
   2674 		return (TRAN_BADPKT);
   2675 	}
   2676 #endif /* ESPDEBUG */
   2677 
   2678 	if (((esp->e_target_scsi_options[Tgt(sp)] & SCSI_OPTIONS_DR) == 0) ||
   2679 	    (esp->e_nodisc & (Tgt(sp) << 1)))  {
   2680 		/*
   2681 		 * no need to reset tag bits since tag queuing will
   2682 		 * not be enabled if disconnects are disabled
   2683 		 */
   2684 		sp->cmd_pkt.pkt_flags |= FLAG_NODISCON;
   2685 	}
   2686 
   2687 	sp->cmd_flags |= CFLAG_PREPARED;
   2688 
   2689 	ASSERT(sp->cmd_flags & CFLAG_IN_TRANSPORT);
   2690 
   2691 	TRACE_0(TR_FAC_SCSI, TR_ESP_PREPARE_PKT_TRAN_ACCEPT_END,
   2692 	    "esp_prepare_pkt_end (tran_accept)");
   2693 	return (TRAN_ACCEPT);
   2694 }
   2695 
   2696 /*
   2697  * when the startQ is emptied, we cannot tolerate TRAN_BUSY.
   2698  * if the queue is not empty when the next request comes in esp_start
   2699  * the order of requests is not preserved
   2700  * if a transport busy condition occurs, we queue up startQ pkts in the ready
   2701  * queue; the disadvantage is that the target driver has initially
   2702  * the wrong value (too high) for the target queue but eventually
   2703  * it should get it right; there is not really a big performance hit here
   2704  */
   2705 static void
   2706 esp_empty_startQ(struct esp *esp)
   2707 {
   2708 	struct esp_cmd *sp;
   2709 	int rval;
   2710 
   2711 	ASSERT(mutex_owned(&esp->e_startQ_mutex));
   2712 
   2713 	TRACE_0(TR_FAC_SCSI, TR_ESP_EMPTY_STARTQ_START,
   2714 	    "esp_empty_startQ_start");
   2715 	while (esp->e_startf) {
   2716 		sp = esp->e_startf;
   2717 		esp->e_startf = sp->cmd_forw;
   2718 		if (esp->e_startb == sp) {
   2719 			esp->e_startb = NULL;
   2720 		}
   2721 		mutex_exit(&esp->e_startQ_mutex);
   2722 		rval = _esp_start(esp, sp, NO_TRAN_BUSY);
   2723 
   2724 		/*
   2725 		 * the request should have been accepted but if not,
   2726 		 * put it back on the head of startQ
   2727 		 * If the  packet was rejected for other reasons then
   2728 		 * complete it here
   2729 		 */
   2730 		if (rval != TRAN_ACCEPT) {
   2731 			if (rval != TRAN_BUSY) {
   2732 				if (sp->cmd_pkt.pkt_reason == CMD_CMPLT) {
   2733 					sp->cmd_pkt.pkt_reason = CMD_TRAN_ERR;
   2734 				}
   2735 				if (sp->cmd_pkt.pkt_comp) {
   2736 					mutex_exit(ESP_MUTEX);
   2737 					(*sp->cmd_pkt.pkt_comp)(&sp->cmd_pkt);
   2738 					mutex_enter(ESP_MUTEX);
   2739 				}
   2740 				mutex_enter(&esp->e_startQ_mutex);
   2741 				continue;
   2742 			}
   2743 			mutex_enter(&esp->e_startQ_mutex);
   2744 			if (esp->e_startf == NULL) {
   2745 				esp->e_startb = esp->e_startf = sp;
   2746 				sp->cmd_forw = NULL;
   2747 			} else {
   2748 				sp->cmd_forw = esp->e_startf;
   2749 				esp->e_startf = sp;
   2750 			}
   2751 			break;
   2752 		}
   2753 		mutex_enter(&esp->e_startQ_mutex);
   2754 	}
   2755 	TRACE_0(TR_FAC_SCSI, TR_ESP_EMPTY_STARTQ_END,
   2756 	    "esp_empty_startQ_end");
   2757 }
   2758 
   2759 /*
   2760  * emptying the startQ just before releasing ESP_MUTEX is
   2761  * tricky; there is a small window where we checked the
   2762  * startQ and emptied it but possibly due to a
   2763  * a kernel preemption, we don't release the ESP_MUTEX soon enough and
   2764  * esp_start() will not be able to get the ESP_MUTEX and exit
   2765  * The next cmd coming in or the next interrupt or esp_watch() would eventually
   2766  * empty the startQ, though
   2767  * Therefore, by releasing the ESP_MUTEX before releasing the startQ mutex,
   2768  * we prevent that esp_start() fills the startQ and then cannot get the
   2769  * ESP_MUTEX for emptying the startQ
   2770  *
   2771  * esp_start() - accept a esp_cmd
   2772  */
   2773 static int
   2774 esp_start(struct scsi_address *ap, struct scsi_pkt *pkt)
   2775 {
   2776 	struct esp_cmd *sp = (struct esp_cmd *)pkt->pkt_ha_private;
   2777 	struct esp *esp = ADDR2ESP(ap);
   2778 	int rval;
   2779 
   2780 	TRACE_0(TR_FAC_SCSI, TR_ESP_START_START, "esp_start_start");
   2781 
   2782 #ifdef ESP_PERF
   2783 	esp_ncmds_per_esp[CNUM]++;
   2784 #endif
   2785 #ifdef ESP_CHECK
   2786 	mutex_enter(ESP_MUTEX);
   2787 	esp_check_in_transport(esp, sp);
   2788 	mutex_exit(ESP_MUTEX);
   2789 #endif
   2790 
   2791 	/*
   2792 	 * prepare packet before taking the mutex
   2793 	 */
   2794 	rval = esp_prepare_pkt(esp, sp);
   2795 	if (rval != TRAN_ACCEPT) {
   2796 		TRACE_0(TR_FAC_SCSI, TR_ESP_START_PREPARE_PKT_END,
   2797 		    "esp_start_end (prepare_pkt)");
   2798 		return (rval);
   2799 	}
   2800 
   2801 	/*
   2802 	 * esp mutex can be held for a long time; therefore, if mutex is
   2803 	 * held, we queue the packet in a startQ; we now need to check
   2804 	 * the startQ on every mutex_exit(ESP_MUTEX);
   2805 	 * Don't put NOINTR cmds in startQ! Proxy cmds go directly
   2806 	 * to _esp_start
   2807 	 */
   2808 	if (sp->cmd_pkt.pkt_flags & FLAG_NOINTR) {
   2809 		mutex_enter(ESP_MUTEX);
   2810 	} else {
   2811 		mutex_enter(&esp->e_startQ_mutex);
   2812 		if (esp->e_startf || (mutex_tryenter(ESP_MUTEX) == 0)) {
   2813 			if (esp->e_startf == NULL) {
   2814 				esp->e_startb = esp->e_startf = sp;
   2815 				sp->cmd_forw = NULL;
   2816 			} else {
   2817 				struct esp_cmd *dp = esp->e_startb;
   2818 				dp->cmd_forw = esp->e_startb = sp;
   2819 				sp->cmd_forw = NULL;
   2820 			}
   2821 			/*
   2822 			 * check again the ESP_MUTEX
   2823 			 */
   2824 			if (mutex_tryenter(ESP_MUTEX)) {
   2825 				esp_empty_startQ(esp);
   2826 				mutex_exit(ESP_MUTEX);
   2827 			}
   2828 			mutex_exit(&esp->e_startQ_mutex);
   2829 			goto done;
   2830 		}
   2831 		mutex_exit(&esp->e_startQ_mutex);
   2832 	}
   2833 
   2834 	rval = _esp_start(esp, sp, TRAN_BUSY_OK);
   2835 	ESP_CHECK_STARTQ_AND_ESP_MUTEX_EXIT(esp);
   2836 	ESP_WAKEUP_CALLBACK_THREAD(esp);
   2837 done:
   2838 	TRACE_1(TR_FAC_SCSI, TR_ESP_START_END, "esp_start_end: esp 0x%p",
   2839 	    (void *)esp);
   2840 	return (rval);
   2841 }
   2842 
   2843 /*
   2844  * _esp_start()
   2845  * the flag argument is to force _esp_start to accept the pkt; pkts that were
   2846  * on startQ cannot be bounced back with TRAN_BUSY
   2847  */
   2848 static int
   2849 _esp_start(struct esp *esp, struct esp_cmd *sp, int flag)
   2850 {
   2851 	short slot;
   2852 	int target = Tgt(sp);
   2853 	int lun = Lun(sp);
   2854 	int rval = TRAN_ACCEPT;
   2855 
   2856 	TRACE_0(TR_FAC_SCSI, TR__ESP_START_START, "_esp_start_start");
   2857 	slot =	(target * NLUNS_PER_TARGET) | lun;
   2858 	ASSERT(mutex_owned(ESP_MUTEX));
   2859 	ASSERT(esp->e_ncmds >= esp->e_ndisc);
   2860 	ASSERT(esp->e_ncmds >= 0 && esp->e_ndisc >= 0);
   2861 
   2862 	if (lun) {
   2863 		EPRINTF("_esp_start: switching target and lun slot scan\n");
   2864 		esp->e_dslot = 1;
   2865 	}
   2866 
   2867 	esp_check_in_transport(esp, sp);
   2868 
   2869 	/*
   2870 	 * prepare (init) packet if this hasn't been done yet and do some checks
   2871 	 */
   2872 	if ((sp->cmd_flags & CFLAG_PREPARED) == 0) {
   2873 		rval = esp_prepare_pkt(esp, sp);
   2874 		if (rval != TRAN_ACCEPT) {
   2875 			IPRINTF1("prepare pkt failed, slot=%x\n", slot);
   2876 #ifdef ESPDEBUG
   2877 			sp->cmd_flags &= ~CFLAG_IN_TRANSPORT;
   2878 #endif
   2879 			goto done;
   2880 		}
   2881 	}
   2882 
   2883 	/*
   2884 	 * At this point we are not going to reject the packet.
   2885 	 * we let proxy packets go thru because these packets don't call a
   2886 	 * target driver completion routine
   2887 	 */
   2888 
   2889 #ifdef ESP_KSTATS
   2890 	/*
   2891 	 * create kstats if not done already
   2892 	 */
   2893 	if (esp_do_kstats) {
   2894 		int slot = (Tgt(sp) * NLUNS_PER_TARGET) | Lun(sp);
   2895 
   2896 		/*
   2897 		 * don't create e_slot_stats if this is an NOINTR cmd; this
   2898 		 * may be just a probing
   2899 		 */
   2900 		if ((esp->e_slot_stats[slot] == NULL) &&
   2901 		    ((sp->cmd_pkt.pkt_flags & FLAG_NOINTR) == 0)) {
   2902 			char buf[32];
   2903 
   2904 			(void) sprintf(buf, "esp%dt%dd", CNUM, target);
   2905 			if ((esp->e_slot_stats[slot] = kstat_create(
   2906 			    buf, lun, NULL, "disk",
   2907 			    KSTAT_TYPE_IO, 1,
   2908 			    KSTAT_FLAG_PERSISTENT)) != NULL) {
   2909 				esp->e_slot_stats[slot]->ks_lock = ESP_MUTEX;
   2910 				kstat_install(esp->e_slot_stats[slot]);
   2911 			}
   2912 		}
   2913 		if (esp->e_slot_stats[slot]) {
   2914 			kstat_waitq_enter(IOSP(slot));
   2915 		}
   2916 	}
   2917 #endif /* ESP_KSTATS */
   2918 
   2919 #ifdef ESP_PERF
   2920 	esp_request_count++;
   2921 #endif
   2922 
   2923 	/*
   2924 	 * we accepted the command; increment the count
   2925 	 * (we may reject later if TRAN_BUSY!; we test this later because
   2926 	 * we don't want to incur the extra overhead here)
   2927 	 */
   2928 	esp->e_ncmds++;
   2929 
   2930 	/*
   2931 	 * if it is a nointr packet, start it now
   2932 	 * (NO_INTR pkts are not queued in the startQ)
   2933 	 */
   2934 	if (sp->cmd_pkt.pkt_flags & FLAG_NOINTR) {
   2935 		EPRINTF("starting a nointr cmd\n");
   2936 		esp_runpoll(esp, slot, sp);
   2937 #ifdef ESPDEBUG
   2938 		sp->cmd_flags &= ~CFLAG_IN_TRANSPORT;
   2939 #endif
   2940 		goto done;
   2941 	}
   2942 
   2943 	/*
   2944 	 * accept the command:
   2945 	 * If no ready que and free slot, run cmd immediately.
   2946 	 * If FLAG_HEAD mode set, run cmd as soon as free slot
   2947 	 * available. if first cmd in ready Q is request sense then insert
   2948 	 * after this cmd (there shouldn't be more than one request sense).
   2949 	 * Queue up the command in the ready queue if this queue is non-empty
   2950 	 * or if we had a queue full condition
   2951 	 */
   2952 	if (esp->e_readyf[slot]) {
   2953 		if (sp->cmd_pkt.pkt_flags & FLAG_HEAD) {
   2954 			struct esp_cmd *ssp = esp->e_readyf[slot];
   2955 			EPRINTF("que head\n");
   2956 			if (*(ssp->cmd_pkt.pkt_cdbp) != SCMD_REQUEST_SENSE) {
   2957 				sp->cmd_forw = ssp;
   2958 				esp->e_readyf[slot] = sp;
   2959 			} else {
   2960 				struct esp_cmd *dp = ssp->cmd_forw;
   2961 				ssp->cmd_forw = sp;
   2962 				sp->cmd_forw = dp;
   2963 				if (esp->e_readyb[slot] == ssp) {
   2964 					esp->e_readyb[slot] = sp;
   2965 				}
   2966 			}
   2967 		} else if ((esp->e_tcmds[slot] >= esp->e_throttle[slot]) &&
   2968 		    (esp->e_throttle[slot] > HOLD_THROTTLE) &&
   2969 		    (flag == TRAN_BUSY_OK)) {
   2970 			IPRINTF2(
   2971 			    "transport busy, slot=%x, ncmds=%x\n",
   2972 			    slot, esp->e_ncmds);
   2973 			rval = TRAN_BUSY;
   2974 			esp->e_ncmds--;
   2975 			sp->cmd_flags &= ~CFLAG_PREPARED;
   2976 #ifdef ESPDEBUG
   2977 			sp->cmd_flags &= ~CFLAG_IN_TRANSPORT;
   2978 #endif
   2979 #ifdef ESP_PERF
   2980 			esp_request_count--;
   2981 #endif
   2982 			goto done;
   2983 		} else {
   2984 			struct esp_cmd *dp = esp->e_readyb[slot];
   2985 
   2986 			EPRINTF("que tail\n");
   2987 			ASSERT(dp != 0);
   2988 			esp->e_readyb[slot] = sp;
   2989 			sp->cmd_forw = NULL;
   2990 			dp->cmd_forw = sp;
   2991 		}
   2992 
   2993 		if ((esp->e_throttle[slot] == DRAIN_THROTTLE) &&
   2994 		    (esp->e_tcmds[slot] == 0)) {
   2995 			esp->e_throttle[slot] = CLEAR_THROTTLE;
   2996 		}
   2997 
   2998 		/*
   2999 		 * just in case that the bus is free and we haven't
   3000 		 * been able to restart for some reason
   3001 		 * XXX this shouldn't really be necessary
   3002 		 */
   3003 		if (esp->e_state == STATE_FREE) {
   3004 			(void) esp_ustart(esp, slot, NEW_CMD);
   3005 		}
   3006 	} else {
   3007 		/*
   3008 		 * for tagged targets with no cmds outstanding and currently
   3009 		 * draining, reset throttle now
   3010 		 * for non-tagged targets and currently draining, always reset
   3011 		 * throttle now (t_cmds is always zero for non-tagged)
   3012 		 */
   3013 		if ((esp->e_tcmds[slot] == 0) && (esp->e_throttle[slot] ==
   3014 		    DRAIN_THROTTLE)) {
   3015 			IPRINTF("reset throttle\n");
   3016 			esp->e_throttle[slot] = CLEAR_THROTTLE;
   3017 		}
   3018 		if ((esp->e_state == STATE_FREE) &&
   3019 		    (esp->e_slots[slot] == NULL) &&
   3020 		    (esp->e_tcmds[slot] < esp->e_throttle[slot])) {
   3021 			EPRINTF("start cmd (maybe)\n");
   3022 			esp->e_cur_slot = slot;
   3023 			esp->e_slots[slot] = sp;
   3024 			(void) esp_startcmd(esp, sp);
   3025 		} else {
   3026 			EPRINTF2(
   3027 			    "cmd not started: e_slot=0x%p, throttle=%x\n",
   3028 			    (void *)esp->e_slots[slot], esp->e_throttle[slot]);
   3029 			esp->e_readyf[slot] = esp->e_readyb[slot] = sp;
   3030 			sp->cmd_forw = NULL;
   3031 		}
   3032 	}
   3033 done:
   3034 	ASSERT(mutex_owned(ESP_MUTEX));
   3035 	TRACE_0(TR_FAC_SCSI, TR__ESP_START_END, "_esp_start_end");
   3036 	return (rval);
   3037 }
   3038 
   3039 static char esp_tag_lookup[] =
   3040 	{0, MSG_HEAD_QTAG, MSG_ORDERED_QTAG, 0, MSG_SIMPLE_QTAG};
   3041 
   3042 static int
   3043 esp_alloc_tag(struct esp *esp, struct esp_cmd *sp)
   3044 {
   3045 	struct t_slots *tag_slots;
   3046 	uchar_t tag;
   3047 	int rval = 0;
   3048 	int target = Tgt(sp);
   3049 	int lun = Lun(sp);
   3050 	short slot = (target * NLUNS_PER_TARGET) | lun;
   3051 
   3052 	TRACE_0(TR_FAC_SCSI, TR_ESP_ALLOC_TAG_START,
   3053 	    "esp_alloc_tag_start");
   3054 	ASSERT(mutex_owned(ESP_MUTEX));
   3055 
   3056 alloc:
   3057 	/*
   3058 	 * allocate tag
   3059 	 * Optimize for the common case, ie. success
   3060 	 */
   3061 	tag_slots = esp->e_tagQ[slot];
   3062 	if (tag_slots != NULL) {
   3063 		tag = (esp->e_tagQ[slot]->e_tags)++;
   3064 		EPRINTF1("tagged cmd, tag = %d\n", tag);
   3065 
   3066 		/* Validate tag, should never fail. */
   3067 		if (tag_slots->t_slot[tag] == 0) {
   3068 			/*
   3069 			 * Store assigned tag and tag queue type.
   3070 			 * Note, in case
   3071 			 * of multiple choice, default to simple queue.
   3072 			 */
   3073 			sp->cmd_tag[1] = tag;
   3074 			sp->cmd_tag[0] = esp_tag_lookup[
   3075 			    ((sp->cmd_pkt.pkt_flags & FLAG_TAGMASK) >> 12)];
   3076 			EPRINTF1("tag= %d\n", tag);
   3077 			tag_slots->t_slot[tag] =  sp;
   3078 			(esp->e_tcmds[slot])++;
   3079 done:
   3080 			ASSERT(mutex_owned(ESP_MUTEX));
   3081 			TRACE_0(TR_FAC_SCSI, TR_ESP_ALLOC_TAG_END,
   3082 			    "esp_alloc_tag_end");
   3083 			return (rval);
   3084 		} else {
   3085 			int age, i;
   3086 
   3087 			/*
   3088 			 * Check tag age.  If timeouts enabled and
   3089 			 * tag age greater than 1, print warning msg.
   3090 			 * If timeouts enabled and tag age greater than
   3091 			 * age limit, begin draining tag que to check for
   3092 			 * lost tag cmd.
   3093 			 */
   3094 			age = tag_slots->t_slot[tag]->cmd_age++;
   3095 			if (age >= esp->e_scsi_tag_age_limit &&
   3096 			    tag_slots->t_slot[tag]->cmd_pkt.pkt_time) {
   3097 				IPRINTF2("tag %d in use, age= %d\n", tag, age);
   3098 				IPRINTF("draining tag queue\n");
   3099 				if (esp->e_reset_delay[Tgt(sp)] == 0) {
   3100 					esp->e_throttle[slot] = DRAIN_THROTTLE;
   3101 				}
   3102 			}
   3103 
   3104 			/* If tag in use, scan until a free one is found. */
   3105 			for (i = 0; i < NTAGS; i++) {
   3106 				tag = esp->e_tagQ[slot]->e_tags;
   3107 				if (!tag_slots->t_slot[tag]) {
   3108 					EPRINTF1("found free tag %d\n", tag);
   3109 					break;
   3110 				}
   3111 				++(esp->e_tagQ[slot]->e_tags);
   3112 				EPRINTF1("found in use tag %d\n", tag);
   3113 			}
   3114 
   3115 			/* If no free tags, we're in serious trouble. */
   3116 			if (tag_slots->t_slot[tag]) {
   3117 				esplog(esp, CE_WARN,
   3118 				    "slot %x: All tags in use!!!\n", slot);
   3119 				rval = -1;
   3120 				goto done;
   3121 			}
   3122 			goto alloc;
   3123 		}
   3124 	} else {
   3125 		EPRINTF2("Target %d.%d allocating tag que\n",
   3126 		    target, Lun(sp));
   3127 		tag_slots = kmem_zalloc(sizeof (struct t_slots), KM_NOSLEEP);
   3128 		if (tag_slots == NULL) {
   3129 			/*
   3130 			 * Couldn't get space for tagged que.  Complain
   3131 			 * and disable tagged queuing.	 It beats
   3132 			 * dying...Seriously, this should not
   3133 			 * happen.
   3134 			 */
   3135 			esplog(esp, CE_WARN,
   3136 			    "Target %d.%d cannot alloc tag queue\n",
   3137 			    target, Lun(sp));
   3138 			esp->e_notag |= 1<<target;
   3139 			sp->cmd_pkt.pkt_flags &=  ~FLAG_TAGMASK;
   3140 			goto done;
   3141 		}
   3142 		esp->e_tagQ[slot] = tag_slots;
   3143 		goto alloc;
   3144 	}
   3145 	_NOTE(NOT_REACHED)
   3146 	/* NOTREACHED */
   3147 }
   3148 
   3149 /*
   3150  * Internal Search Routine.
   3151  *
   3152  * Search for a command to start.
   3153  */
   3154 static int
   3155 esp_istart(struct esp *esp)
   3156 {
   3157 	TRACE_0(TR_FAC_SCSI, TR_ESP_ISTART_START,
   3158 	    "esp_istart_start");
   3159 	EPRINTF("esp_istart:\n");
   3160 
   3161 	if (esp->e_state == STATE_FREE && esp->e_ncmds > esp->e_ndisc) {
   3162 		(void) esp_ustart(esp, esp->e_last_slot, NEW_CMD);
   3163 	}
   3164 	TRACE_0(TR_FAC_SCSI, TR_ESP_ISTART_END,
   3165 	    "esp_istart_end");
   3166 	return (ACTION_RETURN);
   3167 }
   3168 
   3169 static int
   3170 esp_ustart(struct esp *esp, short start_slot, short flag)
   3171 {
   3172 	struct esp_cmd *sp;
   3173 	short slot;
   3174 
   3175 	TRACE_0(TR_FAC_SCSI, TR_ESP_USTART_START, "esp_ustart_start");
   3176 	EPRINTF2("esp_ustart: start_slot=%x, flag=%x\n", start_slot, flag);
   3177 
   3178 
   3179 	switch (flag) {
   3180 	case NEW_CMD:
   3181 	{
   3182 		int found = 0;
   3183 		short dslot = esp->e_dslot;
   3184 
   3185 		slot = start_slot = esp->e_next_slot;
   3186 
   3187 #ifdef ESPDEBUG
   3188 		ASSERT(dslot != 0);
   3189 		if (dslot == NLUNS_PER_TARGET) {
   3190 			ASSERT((slot % NLUNS_PER_TARGET) == 0);
   3191 		}
   3192 #endif /* ESPDEBUG */
   3193 
   3194 		/*
   3195 		 * check each std slot; if it is empty (ie. target not currently
   3196 		 * connected), then check the ready queue for packets
   3197 		 */
   3198 		do {
   3199 			sp = esp->e_slots[slot];
   3200 			if ((sp == 0) && esp->e_readyf[slot] &&
   3201 			    (esp->e_throttle[slot] >  esp->e_tcmds[slot])) {
   3202 				sp = esp->e_readyf[slot];
   3203 				esp->e_readyf[slot] = sp->cmd_forw;
   3204 				if (sp->cmd_forw == NULL) {
   3205 					esp->e_readyb[slot] = NULL;
   3206 				}
   3207 				found++;
   3208 			} else {
   3209 				slot = NEXTSLOT(slot, dslot);
   3210 			}
   3211 		} while (found == 0 && slot != start_slot);
   3212 
   3213 		if (!found) {
   3214 			EPRINTF("esp_ustart: no cmds to start\n");
   3215 			TRACE_0(TR_FAC_SCSI, TR_ESP_USTART_NOT_FOUND_END,
   3216 			    "esp_ustart_end (not_found)");
   3217 			return (FALSE);
   3218 		}
   3219 		esp->e_cur_slot = slot;
   3220 		esp->e_slots[slot] = sp;
   3221 		ASSERT((sp->cmd_pkt.pkt_flags & FLAG_NOINTR) == 0);
   3222 		break;
   3223 	}
   3224 	case SAME_CMD:
   3225 		ASSERT(start_slot != UNDEFINED);
   3226 		slot = esp->e_cur_slot = start_slot;
   3227 		sp = esp->e_slots[start_slot];
   3228 		break;
   3229 	default:
   3230 		TRACE_0(TR_FAC_SCSI, TR_ESP_USTART_DEFAULT_END,
   3231 		    "esp_ustart_end (default)");
   3232 		return (FALSE);
   3233 	}
   3234 
   3235 	esp->e_next_slot = NEXTSLOT(slot, esp->e_dslot);
   3236 
   3237 	TRACE_0(TR_FAC_SCSI, TR_ESP_USTART_END, "esp_ustart_end");
   3238 	return (esp_startcmd(esp, sp));
   3239 }
   3240 
   3241 
   3242 /*
   3243  * Start a command off
   3244  */
   3245 #ifdef ESPDEBUG
   3246 static int esp_cmd_len;
   3247 #endif
   3248 
   3249 static int
   3250 esp_startcmd(struct esp *esp, struct esp_cmd *sp)
   3251 {
   3252 	volatile struct espreg *ep = esp->e_reg;
   3253 	int cmd_len, i, nstate;
   3254 	uchar_t cmd, tshift, target, lun;
   3255 	volatile caddr_t tp = (caddr_t)esp->e_cmdarea;
   3256 	uchar_t offset, period, conf3;
   3257 
   3258 	ASSERT(esp->e_slots[esp->e_cur_slot]->cmd_flags & CFLAG_IN_TRANSPORT);
   3259 	ASSERT(sp == esp->e_slots[esp->e_cur_slot]);
   3260 
   3261 #define	LOAD_CMDP	*(tp++)
   3262 
   3263 	target = Tgt(sp);
   3264 	lun    = Lun(sp);
   3265 	TRACE_0(TR_FAC_SCSI, TR_ESP_STARTCMD_START, "esp_startcmd_start");
   3266 
   3267 	EPRINTF2("esp_startcmd: sp=0x%p flags=%x\n",
   3268 	    (void *)sp, sp->cmd_pkt.pkt_flags);
   3269 
   3270 #ifdef ESPDEBUG
   3271 	if (esp->e_cur_slot != ((target * NLUNS_PER_TARGET) | lun)) {
   3272 		eprintf(esp, "cur_slot=%x, target=%x, lun=%x, sp=0x%p\n",
   3273 		    esp->e_cur_slot, target, lun, (void *)sp);
   3274 		debug_enter("esp_startcmd");
   3275 	}
   3276 	ASSERT((sp->cmd_flags & CFLAG_FREE) == 0);
   3277 	ASSERT(esp->e_reset_delay[Tgt(sp)] == 0);
   3278 #endif
   3279 
   3280 	/*
   3281 	 * if a non-tagged cmd is submitted to an active tagged target
   3282 	 * then drain before submitting this cmd; SCSI-2 allows RQSENSE
   3283 	 * to be untagged
   3284 	 */
   3285 	if (((sp->cmd_pkt.pkt_flags & FLAG_TAGMASK) == 0) &&
   3286 	    TAGGED(Tgt(sp)) && esp->e_tcmds[esp->e_cur_slot] &&
   3287 	    ((sp->cmd_flags & CFLAG_CMDPROXY) == 0) &&
   3288 	    (*(sp->cmd_pkt.pkt_cdbp) != SCMD_REQUEST_SENSE)) {
   3289 		esp->e_slots[esp->e_cur_slot] = NULL;
   3290 		if ((sp->cmd_pkt.pkt_flags & FLAG_NOINTR) == 0) {
   3291 			struct esp_cmd *dp;
   3292 			int slot = esp->e_cur_slot;
   3293 
   3294 			IPRINTF("untagged cmd, start draining\n");
   3295 
   3296 			if (esp->e_reset_delay[Tgt(sp)] == 0) {
   3297 				esp->e_throttle[slot] = DRAIN_THROTTLE;
   3298 			}
   3299 			dp = esp->e_readyf[slot];
   3300 			esp->e_readyf[slot] = sp;
   3301 			sp->cmd_forw = dp;
   3302 			if (esp->e_readyb[slot] == NULL) {
   3303 				esp->e_readyb[slot] = sp;
   3304 			}
   3305 		}
   3306 		return (FALSE);
   3307 	}
   3308 
   3309 	/*
   3310 	 * The only reason that this should happen
   3311 	 * is if we have a re-selection attempt starting.
   3312 	 */
   3313 	if (INTPENDING(esp)) {
   3314 		int slot;
   3315 		struct esp_cmd *dp;
   3316 
   3317 		slot = esp->e_cur_slot;
   3318 		ESP_PREEMPT(esp);
   3319 		LOG_STATE(esp, ACTS_PREEMPTED, esp->e_stat, Tgt(sp), lun);
   3320 		TRACE_0(TR_FAC_SCSI, TR_ESP_STARTCMD_PREEMPT_CALL,
   3321 		    "esp_startcmd_preempt_call");
   3322 		/*
   3323 		 * put request back in the ready queue
   3324 		 * runpoll will retry NOINTR cmds so no need to put
   3325 		 * those on ready Q
   3326 		 */
   3327 		if ((sp->cmd_pkt.pkt_flags & FLAG_NOINTR) == 0) {
   3328 			esp->e_slots[slot] = (struct esp_cmd *)NULL;
   3329 			dp = esp->e_readyf[slot];
   3330 			esp->e_readyf[slot] = sp;
   3331 			sp->cmd_forw = dp;
   3332 			if (esp->e_readyb[slot] == NULL) {
   3333 				esp->e_readyb[slot] = sp;
   3334 			}
   3335 			esp->e_polled_intr = 1;
   3336 			espsvc(esp);
   3337 		}
   3338 		TRACE_0(TR_FAC_SCSI, TR_ESP_STARTCMD_RE_SELECTION_END,
   3339 		    "esp_startcmd_end (re_selection)");
   3340 		return (FALSE);
   3341 	}
   3342 
   3343 	/*
   3344 	 * allocate a tag; if no tag available then put request back
   3345 	 * on the ready queue and return; eventually a cmd completes and we
   3346 	 * get going again
   3347 	 */
   3348 	if (sp->cmd_pkt.pkt_flags & FLAG_TAGMASK) {
   3349 		if ((esp_alloc_tag(esp, sp))) {
   3350 			int slot;
   3351 			struct esp_cmd *dp;
   3352 
   3353 			slot = esp->e_cur_slot;
   3354 			dp = esp->e_readyf[slot];
   3355 			esp->e_readyf[slot] = sp;
   3356 			sp->cmd_forw = dp;
   3357 			if (esp->e_readyb[slot] == NULL) {
   3358 				esp->e_readyb[slot] = sp;
   3359 			}
   3360 			esp->e_slots[slot] = NULL;
   3361 			esp->e_last_slot = esp->e_cur_slot;
   3362 			esp->e_cur_slot = UNDEFINED;
   3363 			TRACE_0(TR_FAC_SCSI, TR_ESP_STARTCMD_ALLOC_TAG2_END,
   3364 			    "esp_startcmd_end (alloc_tag2)");
   3365 			return (FALSE);
   3366 		}
   3367 	} else {
   3368 		if (TAGGED(target)) {
   3369 			if (*(sp->cmd_pkt.pkt_cdbp) != SCMD_REQUEST_SENSE) {
   3370 				esp->e_throttle[esp->e_cur_slot] = 1;
   3371 			}
   3372 		}
   3373 	}
   3374 	esp->e_sdtr = esp->e_omsglen = 0;
   3375 	tshift = 1<<target;
   3376 
   3377 #ifdef	ESPDEBUG
   3378 	esp->e_xfer = sp->cmd_dmacount;
   3379 #endif	/* ESPDEBUG */
   3380 
   3381 	/*
   3382 	 * The ESP chip will only automatically
   3383 	 * send 6, 10 or 12 byte SCSI cmds.
   3384 	 * NOTE: if cmd_len is 0, we xfer cmd bytes one at the time
   3385 	 * Also note that the "SELECT with ATN and STOP" stops with ATN
   3386 	 * asserted; if no msg is available, we send a NOP. Some targets
   3387 	 * may not like this.
   3388 	 */
   3389 	cmd_len = sp->cmd_cdblen;
   3390 
   3391 #ifdef ESPDEBUG
   3392 	if (esp_cmd_len)
   3393 		cmd_len = 0;
   3394 #endif
   3395 
   3396 	if ((sp->cmd_pkt.pkt_flags & FLAG_TAGMASK) &&
   3397 	    (esp->e_sync_known & tshift ||
   3398 	    (esp->e_target_scsi_options[target] & SCSI_OPTIONS_SYNC) == 0)) {
   3399 		EPRINTF("tag cmd\n");
   3400 
   3401 		ASSERT((sp->cmd_pkt.pkt_flags & FLAG_NODISCON) == 0);
   3402 		LOAD_CMDP = esp->e_last_msgout = MSG_DR_IDENTIFY | lun;
   3403 
   3404 		if (cmd_len) {
   3405 			LOAD_CMDP = sp->cmd_tag[0];
   3406 			LOAD_CMDP = sp->cmd_tag[1];
   3407 
   3408 			nstate = STATE_SELECT_NORMAL;
   3409 			cmd = CMD_SEL_ATN3 | CMD_DMA;
   3410 
   3411 		} else {
   3412 			esp->e_cur_msgout[0] = sp->cmd_tag[0];
   3413 			esp->e_cur_msgout[1] = sp->cmd_tag[1];
   3414 			esp->e_omsglen = 2;
   3415 			EPRINTF2("tag %d, omsglen=%x\n",
   3416 			    sp->cmd_tag[1], esp->e_omsglen);
   3417 
   3418 			cmd_len = 0;
   3419 			nstate = STATE_SELECT_N_TAG;
   3420 			cmd = CMD_SEL_STOP | CMD_DMA;
   3421 		}
   3422 		LOG_STATE(esp, ACTS_SELECT, target, lun, -1);
   3423 		LOG_STATE(esp, ACTS_TAG, sp->cmd_tag[0], sp->cmd_tag[1], -1);
   3424 
   3425 	} else if (sp->cmd_flags & CFLAG_CMDPROXY) {
   3426 
   3427 		IPRINTF2("proxy cmd, len=%x, msg=%x\n",
   3428 		    sp->cmd_cdb[ESP_PROXY_DATA],
   3429 		    sp->cmd_cdb[ESP_PROXY_DATA+1]);
   3430 
   3431 		/*
   3432 		 * This is a proxy command. It will have
   3433 		 * a message to send as part of post-selection
   3434 		 * (e.g, MSG_ABORT or MSG_DEVICE_RESET)
   3435 		 * XXX: We should check to make sure that
   3436 		 * this is a valid PROXY command, i.e,
   3437 		 * a  valid message length.
   3438 		 */
   3439 		LOAD_CMDP = esp->e_last_msgout = MSG_IDENTIFY | lun;
   3440 		esp->e_omsglen = sp->cmd_cdb[ESP_PROXY_DATA];
   3441 		for (i = 0; i < (uint_t)esp->e_omsglen; i++) {
   3442 			esp->e_cur_msgout[i] =
   3443 			    sp->cmd_cdb[ESP_PROXY_DATA+1+i];
   3444 		}
   3445 		sp->cmd_cdb[ESP_PROXY_RESULT] = FALSE;
   3446 		nstate = STATE_SELECT_N_SENDMSG;
   3447 		cmd = CMD_SEL_STOP | CMD_DMA;
   3448 		cmd_len = 0;
   3449 		LOG_STATE(esp, ACTS_PROXY, esp->e_stat,
   3450 		    esp->e_cur_msgout[0], nstate);
   3451 
   3452 	} else if (((esp->e_sync_known & tshift) == 0) &&
   3453 	    (esp->e_target_scsi_options[target] & SCSI_OPTIONS_SYNC)) {
   3454 
   3455 		if (sp->cmd_pkt.pkt_flags & FLAG_NODISCON) {
   3456 			LOAD_CMDP = esp->e_last_msgout = MSG_IDENTIFY | lun;
   3457 			ASSERT((sp->cmd_pkt.pkt_flags & FLAG_TAGMASK) == 0);
   3458 		} else {
   3459 			LOAD_CMDP = esp->e_last_msgout =
   3460 			    MSG_DR_IDENTIFY | lun;
   3461 		}
   3462 
   3463 		/*
   3464 		 * Set up to send synch. negotiating message.  This is getting
   3465 		 * a bit tricky as we dma out the identify message and
   3466 		 * send the other messages via the fifo buffer.
   3467 		 */
   3468 		EPRINTF1("cmd with sdtr msg, tag=%x\n", sp->cmd_tag[1]);
   3469 		LOG_STATE(esp, ACTS_SELECT, target, lun, -1);
   3470 
   3471 		/* First the tag message bytes */
   3472 		i = 0;
   3473 		if (sp->cmd_pkt.pkt_flags & FLAG_TAGMASK) {
   3474 			esp->e_cur_msgout[i++] = sp->cmd_tag[0];
   3475 			esp->e_cur_msgout[i++] = sp->cmd_tag[1];
   3476 			LOG_STATE(esp, ACTS_TAG,
   3477 			    sp->cmd_tag[0], sp->cmd_tag[1], -1);
   3478 		}
   3479 
   3480 		if (esp->e_weak & tshift) {
   3481 			nstate = STATE_SELECT_NORMAL;
   3482 			cmd = CMD_SEL_ATN | CMD_DMA;
   3483 		} else {
   3484 			int period = esp->e_default_period[target];
   3485 			int offset = DEFAULT_OFFSET;
   3486 
   3487 			if (esp->e_force_async & (1<<target)) {
   3488 				offset = 0;
   3489 			}
   3490 			if (esp->e_backoff[target] == 1) {
   3491 				period = esp->e_neg_period[target];
   3492 			} else if (esp->e_backoff[target] > 1) {
   3493 				period = esp->e_neg_period[target];
   3494 				offset = 0;
   3495 			}
   3496 			esp_make_sdtr(esp, i, (int)period,
   3497 			    (int)offset);
   3498 			LOG_STATE(esp, ACTS_SYNCHOUT, esp->e_stat,
   3499 			    period, offset);
   3500 			cmd_len = 0;
   3501 			cmd = CMD_SEL_STOP | CMD_DMA;
   3502 			nstate = STATE_SELECT_N_SENDMSG;
   3503 		}
   3504 		/*
   3505 		 * XXX: Set sync known here because the Sony CDrom
   3506 		 * ignores the synch negotiation msg. Net effect
   3507 		 * is we negotiate on every I/O request forever.
   3508 		 */
   3509 		esp->e_sync_known |= (1<<target);
   3510 
   3511 	} else	{
   3512 
   3513 		ASSERT((sp->cmd_pkt.pkt_flags & FLAG_TAGMASK) == 0);
   3514 
   3515 		if (sp->cmd_pkt.pkt_flags & FLAG_NODISCON) {
   3516 			LOAD_CMDP = esp->e_last_msgout = MSG_IDENTIFY | lun;
   3517 		} else {
   3518 			LOAD_CMDP = esp->e_last_msgout =
   3519 			    MSG_DR_IDENTIFY | lun;
   3520 		}
   3521 
   3522 		/* Send cmd. */
   3523 		if (cmd_len) {
   3524 			EPRINTF("std. cmd\n");
   3525 			nstate = STATE_SELECT_NORMAL;
   3526 			cmd = CMD_SEL_ATN | CMD_DMA;
   3527 		/*
   3528 		 * XXX: Things get a bit complicated for cdb's the esp
   3529 		 *	chip doesn't understand.  We have to send them out
   3530 		 *	one byte at a time.  This is not a fast process!
   3531 		 */
   3532 		} else {
   3533 			IPRINTF("sending special cmd\n");
   3534 			cmd = CMD_SEL_STOP | CMD_DMA;
   3535 			nstate = STATE_SELECT_N_STOP;
   3536 		}
   3537 		LOG_STATE(esp, ACTS_SELECT, target, lun, -1);
   3538 	}
   3539 
   3540 	/*
   3541 	 * Now load cdb (if any)
   3542 	 */
   3543 	for (i = 0; i < cmd_len; i++) {
   3544 		LOAD_CMDP = sp->cmd_cdbp[i];
   3545 	}
   3546 	if (cmd_len) {
   3547 		LOG_STATE(esp, ACTS_CMD_START, esp->e_stat, sp->cmd_cdbp[0],
   3548 		    nstate);
   3549 	}
   3550 
   3551 	/*
   3552 	 * calculate total dma amount:
   3553 	 */
   3554 	esp->e_lastcount = (uintptr_t)tp - (uintptr_t)esp->e_cmdarea;
   3555 
   3556 	/*
   3557 	 * load rest of chip registers, if needed
   3558 	 */
   3559 	ep->esp_busid = target;
   3560 
   3561 	period =  esp->e_period[target] & SYNC_PERIOD_MASK;
   3562 	offset = esp->e_offset[target];
   3563 	conf3 = esp->e_espconf3[target];
   3564 	if ((esp->e_period_last != period) ||
   3565 	    (esp->e_offset_last != offset) ||
   3566 	    (esp->e_espconf3_last != conf3)) {
   3567 		esp->e_period_last = ep->esp_sync_period = period;
   3568 		esp->e_offset_last = ep->esp_sync_offset = offset;
   3569 		esp->e_espconf3_last = ep->esp_conf3 = conf3;
   3570 	}
   3571 
   3572 	if ((esp->e_target_scsi_options[target] & SCSI_OPTIONS_PARITY) &&
   3573 	    (sp->cmd_pkt.pkt_flags & FLAG_NOPARITY)) {
   3574 		ep->esp_conf = esp->e_espconf & ~ESP_CONF_PAREN;
   3575 	}
   3576 	SET_DMAESC_COUNT(esp->e_dma, esp->e_esc_read_count);
   3577 	ESP_DMA_READ(esp, esp->e_lastcount, esp->e_dmacookie.dmac_address);
   3578 
   3579 	Esp_cmd(esp, (int)cmd);
   3580 	New_state(esp, (int)nstate);
   3581 	LOG_STATE(esp, nstate, esp->e_stat, target, lun);
   3582 
   3583 #ifdef ESPDEBUG
   3584 	if (DEBUGGING) {
   3585 		auto char buf[256];
   3586 		buf[0] = '\0';
   3587 		(void) sprintf(&buf[strlen(buf)], "sel %d.%d cmd[ ",
   3588 		    target, lun);
   3589 		for (i = 0; i < (int)sp->cmd_cdblen; i++) {
   3590 			(void) sprintf(&buf[strlen(buf)],
   3591 			    "0x%x ", sp->cmd_cdbp[i] & 0xff);
   3592 		}
   3593 		(void) sprintf(&buf[strlen(buf)], "]\n\tstate=%s\n",
   3594 		    esp_state_name(esp->e_state));
   3595 		eprintf(esp, "%s", buf);
   3596 	}
   3597 #endif /* ESPDEBUG */
   3598 
   3599 	/*
   3600 	 * set up timeout here; there is a risk of preemption in which
   3601 	 * case we don't adjust the timeout. So, we hope that this
   3602 	 * cmd gets started fairly quickly after a preemption.
   3603 	 */
   3604 	if (sp->cmd_pkt.pkt_flags & FLAG_TAGMASK) {
   3605 		short slot = esp->e_cur_slot;
   3606 		struct t_slots *tag_slots = esp->e_tagQ[slot];
   3607 
   3608 		i = sp->cmd_pkt.pkt_time - tag_slots->e_timebase;
   3609 
   3610 		if (i == 0) {
   3611 			EPRINTF("dup timeout\n");
   3612 			(tag_slots->e_dups)++;
   3613 			tag_slots->e_timeout = tag_slots->e_timebase;
   3614 		} else if (i > 0) {
   3615 			EPRINTF("new timeout\n");
   3616 			tag_slots->e_timeout = tag_slots->e_timebase =
   3617 			    sp->cmd_pkt.pkt_time;
   3618 			tag_slots->e_dups = 1;
   3619 		}
   3620 	}
   3621 
   3622 #ifdef ESP_KSTATS
   3623 	if (esp_do_kstats && esp->e_slot_stats[esp->e_cur_slot]) {
   3624 		kstat_waitq_to_runq(IOSP(esp->e_cur_slot));
   3625 	}
   3626 #endif /* ESP_KSTATS */
   3627 	TRACE_0(TR_FAC_SCSI, TR_ESP_STARTCMD_END, "esp_startcmd_end");
   3628 
   3629 	return (TRUE);
   3630 }
   3631 
   3632 /*
   3633  * Autovector Interrupt Entry Point.
   3634  *
   3635  */
   3636 
   3637 static uint_t
   3638 esp_intr(caddr_t arg)
   3639 {
   3640 	struct esp *esp = (struct esp *)arg;
   3641 	int kstat_updated = 0;
   3642 	int rval = DDI_INTR_UNCLAIMED;
   3643 
   3644 #ifdef ESP_PERF
   3645 	esp_intr_count++;
   3646 #endif
   3647 	do {
   3648 		mutex_enter(ESP_MUTEX);
   3649 		while (INTPENDING(esp)) {
   3650 			espsvc(esp);
   3651 			rval = DDI_INTR_CLAIMED;
   3652 		}
   3653 
   3654 		if (esp->e_polled_intr) {
   3655 			rval = DDI_INTR_CLAIMED;
   3656 			esp->e_polled_intr = 0;
   3657 		}
   3658 		if (!kstat_updated && esp->e_intr_kstat &&
   3659 		    rval == DDI_INTR_CLAIMED) {
   3660 			ESP_KSTAT_INTR(esp);
   3661 			kstat_updated++;
   3662 		}
   3663 
   3664 		/*
   3665 		 * check and empty the startQ
   3666 		 */
   3667 		ESP_CHECK_STARTQ_AND_ESP_MUTEX_EXIT(esp);
   3668 		ESP_WAKEUP_CALLBACK_THREAD(esp);
   3669 	} while (INTPENDING(esp));
   3670 
   3671 	return (rval);
   3672 }
   3673 
   3674 /*
   3675  * General interrupt service routine.
   3676  */
   3677 static char *dmaga_bits = DMAGA_BITS;
   3678 
   3679 static void
   3680 espsvc(struct esp *esp)
   3681 {
   3682 	static int (*evec[])(struct esp *esp) = {
   3683 		esp_finish_select,
   3684 		esp_reconnect,
   3685 		esp_phasemanage,
   3686 		esp_finish,
   3687 		esp_reset_recovery,
   3688 		esp_istart,
   3689 		esp_abort_curcmd,
   3690 		esp_abort_allcmds,
   3691 		esp_reset_bus,
   3692 		esp_handle_selection
   3693 	};
   3694 	int action;
   3695 	uchar_t intr;
   3696 	volatile struct espreg *ep = esp->e_reg;
   3697 	int i = 0;
   3698 
   3699 	TRACE_0(TR_FAC_SCSI, TR_ESPSVC_START, "espsvc_start");
   3700 
   3701 	/*
   3702 	 * A read of ESP interrupt register clears interrupt,
   3703 	 * so any other volatile information needs to be latched
   3704 	 * up prior to reading the interrupt register.
   3705 	 */
   3706 	esp->e_stat = ep->esp_stat;
   3707 
   3708 	/*
   3709 	 * unclear what could cause a gross error;
   3710 	 * most of the time we get a data overrun after this.
   3711 	 */
   3712 	if (esp->e_stat & ESP_STAT_GERR) {
   3713 		esplog(esp, CE_WARN,
   3714 		    "gross error in esp status (%x)", esp->e_stat);
   3715 		IPRINTF5("esp_cmd=%x, stat=%x, intr=%x, step=%x, fifoflag=%x\n",
   3716 		    ep->esp_cmd, esp->e_stat, esp->e_intr, ep->esp_step,
   3717 		    ep->esp_fifo_flag);
   3718 		if (esp->e_cur_slot != UNDEFINED) {
   3719 			struct esp_cmd *sp = CURRENT_CMD(esp);
   3720 			if (sp->cmd_pkt.pkt_reason == CMD_CMPLT) {
   3721 				sp->cmd_pkt.pkt_reason = CMD_TRAN_ERR;
   3722 			}
   3723 		} else {
   3724 			action = ACTION_ABORT_ALLCMDS;
   3725 			goto start_action;
   3726 		}
   3727 	}
   3728 
   3729 #ifdef ESPDEBUG
   3730 	if (esp_check_dma_error(esp)) {
   3731 		action = ACTION_RESET;
   3732 		goto start_action;
   3733 	}
   3734 #endif
   3735 
   3736 	/*
   3737 	 * the esp may post an interrupt even though we have just reset
   3738 	 * the bus and blown away the targets; therefore, check on
   3739 	 * reset state first and deal with reset recovery immediately
   3740 	 */
   3741 	if (esp->e_state == ACTS_RESET) {
   3742 		action = ACTION_FINRST;
   3743 		goto start_action;
   3744 	}
   3745 
   3746 
   3747 	/*
   3748 	 * While some documentation claims that the
   3749 	 * ESP100A's msb in the stat register is an
   3750 	 * INTERRUPT PENDING bit, an errata sheet
   3751 	 * warned that you shouldn't depend on that
   3752 	 * being so (unless you're an ESP-236)
   3753 	 */
   3754 	if (esp->e_options & ESP_OPT_MASK_OFF_STAT) {
   3755 		esp->e_stat &= ~ESP_STAT_RES;
   3756 	} else	if ((esp->e_stat & ESP_STAT_IPEND) == 0) {
   3757 		esp->e_intr = intr = ep->esp_intr;
   3758 		if (esp->e_intr & ESP_INT_RESET) {
   3759 			action = ACTION_FINRST;
   3760 			goto start_action;
   3761 		}
   3762 
   3763 		if (esp_check_dma_error(esp)) {
   3764 			action = ACTION_RESET;
   3765 			goto start_action;
   3766 		}
   3767 
   3768 		esplog(esp, CE_WARN, "Spurious interrupt");
   3769 		action = ACTION_RETURN;
   3770 		goto exit;
   3771 	}
   3772 
   3773 	/*
   3774 	 * now it is finally safe to read the interrupt register
   3775 	 */
   3776 	esp->e_intr = intr = ep->esp_intr;
   3777 
   3778 #ifdef	ESPDEBUG
   3779 	if (DEBUGGING) {
   3780 		eprintf(esp, "espsvc: dma csr 0x%b addr 0x%x\n",
   3781 		    esp->e_dma->dmaga_csr, dmaga_bits, esp->e_dma->dmaga_addr);
   3782 		esp_stat_int_print(esp);
   3783 		eprintf(esp, "\tState %s Laststate %s\n",
   3784 		    esp_state_name(esp->e_state),
   3785 		    esp_state_name(esp->e_laststate));
   3786 	}
   3787 #endif	/* ESPDEBUG */
   3788 
   3789 	/*
   3790 	 * Based upon the current state of the host adapter driver
   3791 	 * we should be able to figure out what to do with an interrupt.
   3792 	 * We have several possible interrupt sources, some of them
   3793 	 * modified by various status conditions.
   3794 	 *
   3795 	 * Basically, we'll get an interrupt through the dma gate array
   3796 	 * for one or more of the following three conditions:
   3797 	 *
   3798 	 *	1. The ESP is asserting an interrupt request.
   3799 	 *
   3800 	 *	2. There has been a memory exception of some kind.
   3801 	 *
   3802 	 * In the latter case we are either in one of the SCSI
   3803 	 * DATA phases or are using dma in sending a command to a
   3804 	 * target. We will let the various handlers for these kind
   3805 	 * of states decode any error conditions in the gate array.
   3806 	 *
   3807 	 * The ESP asserts an interrupt with one or more of 8 possible
   3808 	 * bits set in its interrupt register. These conditions are
   3809 	 * SCSI bus reset detected, an illegal command fed to the ESP,
   3810 	 * one of DISCONNECT, BUS SERVICE, FUNCTION COMPLETE conditions
   3811 	 * for the ESP, a Reselection interrupt, or one of Selection
   3812 	 * or Selection with Attention.
   3813 	 *
   3814 	 * Of these possible interrupts, we can deal with some right
   3815 	 * here and now, irrespective of the current state of the driver.
   3816 	 *
   3817 	 * take care of the most likely interrupts first and call the action
   3818 	 * immediately
   3819 	 */
   3820 	if ((intr & (ESP_INT_RESET|ESP_INT_ILLEGAL|ESP_INT_SEL|ESP_INT_SELATN|
   3821 	    ESP_INT_RESEL)) == 0) {
   3822 		/*
   3823 		 * The rest of the reasons for an interrupt, including
   3824 		 * interrupts just from the dma gate array itself, can
   3825 		 * be handled based purely on the state that the driver
   3826 		 * is currently in now.
   3827 		 */
   3828 		if (esp->e_state & STATE_SELECTING) {
   3829 			action = esp_finish_select(esp);
   3830 
   3831 		} else if (esp->e_state & STATE_ITPHASES) {
   3832 			action = esp_phasemanage(esp);
   3833 
   3834 		} else {
   3835 #ifdef	ESPDEBUG
   3836 			esp_printstate(esp, "spurious interrupt");
   3837 #endif	/* ESPDEBUG */
   3838 			esplog(esp, CE_WARN, "spurious interrupt");
   3839 			action = ACTION_RETURN;
   3840 		}
   3841 
   3842 	} else if ((intr & ESP_INT_RESEL) && ((intr &
   3843 	    (ESP_INT_RESET|ESP_INT_ILLEGAL|ESP_INT_SEL|ESP_INT_SELATN)) == 0)) {
   3844 
   3845 		if (esp->e_state & STATE_SELECTING) {
   3846 			action = esp_finish_select(esp);
   3847 
   3848 		} else if (esp->e_state != STATE_FREE) {
   3849 			/*
   3850 			 * this 'cannot happen'.
   3851 			 */
   3852 			esp_printstate(esp, "illegal reselection");
   3853 			action = ACTION_RESET;
   3854 		} else {
   3855 			action = esp_reconnect(esp);
   3856 		}
   3857 
   3858 
   3859 	} else if (intr & ESP_INT_RESET) {
   3860 		/*
   3861 		 * If we detect a SCSI reset, we blow away the current
   3862 		 * command (if there is one) and all disconnected commands
   3863 		 * because we now don't know the state of them at all.
   3864 		 */
   3865 		action = ACTION_FINRST;
   3866 
   3867 	} else if (intr & ESP_INT_ILLEGAL) {
   3868 		/*
   3869 		 * This should not happen. The one situation where
   3870 		 * we can get an ILLEGAL COMMAND interrupt is due to
   3871 		 * a bug in the ESP100 during reselection which we
   3872 		 * should be handling in esp_reconnect().
   3873 		 */
   3874 		IPRINTF1("lastcmd=%x\n", esp->e_reg->esp_cmd);
   3875 		esp_printstate(esp, "ILLEGAL bit set");
   3876 		action = ACTION_RESET;
   3877 
   3878 	} else if (intr & (ESP_INT_SEL|ESP_INT_SELATN)) {
   3879 		action = ACTION_SELECT;
   3880 	}
   3881 
   3882 start_action:
   3883 	while (action != ACTION_RETURN) {
   3884 		ASSERT((action >= 0) && (action <= ACTION_SELECT));
   3885 		TRACE_3(TR_FAC_SCSI, TR_ESPSVC_ACTION_CALL,
   3886 		    "espsvc call: esp 0x%p, action %d (%d)",
   3887 		    (void *)esp, action, i);
   3888 		i++;
   3889 		action = (*evec[action])(esp);
   3890 	}
   3891 exit:
   3892 	TRACE_0(TR_FAC_SCSI, TR_ESPSVC_END, "espsvc_end");
   3893 }
   3894 
   3895 
   3896 /*
   3897  * Manage phase transitions.
   3898  */
   3899 static int
   3900 esp_phasemanage(struct esp *esp)
   3901 {
   3902 	ushort_t state;
   3903 	int action;
   3904 	static int (*pvecs[])(struct esp *esp) = {
   3905 		esp_handle_cmd_start,
   3906 		esp_handle_cmd_done,
   3907 		esp_handle_msg_out,
   3908 		esp_handle_msg_out_done,
   3909 		esp_handle_msg_in,
   3910 		esp_handle_more_msgin,
   3911 		esp_handle_msg_in_done,
   3912 		esp_handle_clearing,
   3913 		esp_handle_data,
   3914 		esp_handle_data_done,
   3915 		esp_handle_c_cmplt,
   3916 		esp_reconnect
   3917 	};
   3918 	int i = 0;
   3919 
   3920 	TRACE_0(TR_FAC_SCSI, TR_ESP_PHASEMANAGE_START, "esp_phasemanage_start");
   3921 
   3922 	do {
   3923 		EPRINTF1("esp_phasemanage: %s\n",
   3924 		    esp_state_name(esp->e_state & STATE_ITPHASES));
   3925 
   3926 		TRACE_2(TR_FAC_SCSI, TR_ESP_PHASEMANAGE_CALL,
   3927 		    "esp_phasemanage_call: esp 0x%p (%d)", (void *)esp, i);
   3928 
   3929 		i++;
   3930 		state = esp->e_state;
   3931 
   3932 		if (state == ACTS_UNKNOWN) {
   3933 			action = esp_handle_unknown(esp);
   3934 		} else if (state == STATE_FREE || state > ACTS_ENDVEC) {
   3935 			esplog(esp, CE_WARN, "lost state in phasemanage");
   3936 			action = ACTION_ABORT_ALLCMDS;
   3937 		} else {
   3938 			ASSERT(pvecs[state-1] != NULL);
   3939 			action = (*pvecs[state-1]) (esp);
   3940 		}
   3941 
   3942 	} while (action == ACTION_PHASEMANAGE);
   3943 
   3944 	TRACE_0(TR_FAC_SCSI, TR_ESP_PHASEMANAGE_END, "esp_phasemanage_end");
   3945 	return (action);
   3946 }
   3947 
   3948 /*
   3949  * remove a tagged cmd from t_slot list and if timeout is set, then
   3950  * adjust timeouts; if a the same cmd will be resubmitted soon, don't
   3951  * bother to adjust timeouts
   3952  */
   3953 static void
   3954 esp_remove_tagged_cmd(struct esp *esp, struct esp_cmd *sp, int slot,
   3955     int new_timeout_flag)
   3956 {
   3957 	ASSERT(sp != NULL);
   3958 	ASSERT(slot >= 0 && slot < N_SLOTS);
   3959 	ASSERT(esp->e_ncmds >= esp->e_ndisc);
   3960 
   3961 	if (sp->cmd_pkt.pkt_flags & FLAG_TAGMASK) {
   3962 		int tag = sp->cmd_tag[1];
   3963 		struct t_slots *tag_slots = esp->e_tagQ[slot];
   3964 
   3965 		EPRINTF4("remove tag %d slot %d for target %d.%d\n",
   3966 		    tag, slot, Tgt(sp), Lun(sp));
   3967 
   3968 		ASSERT(sp != esp->e_slots[slot]);
   3969 		ASSERT(tag_slots != NULL);
   3970 
   3971 		if (sp == tag_slots->t_slot[tag]) {
   3972 			tag_slots->t_slot[tag] = NULL;
   3973 			esp->e_tcmds[slot]--;
   3974 		}
   3975 		ASSERT(esp->e_tcmds[slot] >= 0);
   3976 
   3977 		/*
   3978 		 * If all cmds drained from tag Q, clear throttle and
   3979 		 * start queuing up new cmds again.
   3980 		 */
   3981 		if (esp->e_throttle[slot] == DRAIN_THROTTLE &&
   3982 		    esp->e_tcmds[slot] == 0) {
   3983 			IPRINTF("reset throttle\n");
   3984 			esp->e_throttle[slot] = CLEAR_THROTTLE;
   3985 		}
   3986 		if (new_timeout_flag != NEW_TIMEOUT) {
   3987 			return;
   3988 		}
   3989 
   3990 		/*
   3991 		 * Figure out what to set tag Q timeout for...
   3992 		 *
   3993 		 * Optimize: If we have duplicate's of same timeout
   3994 		 * we're using, then we'll use it again until we run
   3995 		 * out of duplicates.  This should be the normal case
   3996 		 * for block and raw I/O.
   3997 		 * If no duplicates, we have to scan through tag que and
   3998 		 * find the longest timeout value and use it.  This is
   3999 		 * going to take a while...
   4000 		 */
   4001 		if (sp->cmd_pkt.pkt_time == tag_slots->e_timebase) {
   4002 			if (--(tag_slots->e_dups) <= 0) {
   4003 			if (esp->e_tcmds[slot]) {
   4004 				struct esp_cmd *ssp;
   4005 				uint_t n = 0;
   4006 				int i;
   4007 
   4008 				/*
   4009 				 * This crude check assumes we don't do
   4010 				 * this too often which seems reasonable
   4011 				 * for block and raw I/O.
   4012 				 */
   4013 				for (i = 0; i < NTAGS; i++) {
   4014 					ssp = tag_slots->t_slot[i];
   4015 					if (ssp == NULL) {
   4016 						continue;
   4017 					}
   4018 					if (ssp->cmd_pkt.pkt_time > n) {
   4019 						n = ssp->cmd_pkt.pkt_time;
   4020 						tag_slots->e_dups = 1;
   4021 					} else if (
   4022 					    ssp->cmd_pkt.pkt_time == n) {
   4023 						tag_slots->e_dups++;
   4024 					}
   4025 				}
   4026 				tag_slots->e_timebase = n;
   4027 			} else {
   4028 				tag_slots->e_dups =
   4029 				    tag_slots->e_timebase = 0;
   4030 			}
   4031 			}
   4032 		}
   4033 		tag_slots->e_timeout = tag_slots->e_timebase;
   4034 	}
   4035 }
   4036 
   4037 
   4038 /*
   4039  * Most commonly called phase handlers:
   4040  *
   4041  * Finish routines
   4042  */
   4043 static int
   4044 esp_finish(struct esp *esp)
   4045 {
   4046 	short last_slot;
   4047 	struct esp_cmd *sp = CURRENT_CMD(esp);
   4048 	int action = ACTION_SEARCH;
   4049 	struct scsi_status *status =
   4050 	    (struct  scsi_status *)sp->cmd_pkt.pkt_scbp;
   4051 
   4052 	TRACE_0(TR_FAC_SCSI, TR_ESP_FINISH_START,
   4053 	    "esp_finish_start");
   4054 	EPRINTF("esp_finish\n");
   4055 	ASSERT(esp->e_ncmds > esp->e_ndisc);
   4056 
   4057 	if ((sp->cmd_pkt.pkt_state & STATE_GOT_STATUS) == 0) {
   4058 		status->sts_chk = 0;
   4059 	}
   4060 
   4061 	last_slot = esp->e_last_slot = esp->e_cur_slot;
   4062 	esp->e_cur_slot = UNDEFINED;
   4063 	esp->e_ncmds--;
   4064 	sp->cmd_flags |= CFLAG_FINISHED;
   4065 
   4066 
   4067 #ifdef ESP_TEST_UNTAGGED
   4068 	if (esp_test_stop && (sp->cmd_pkt.pkt_flags & 0x80000000)) {
   4069 		debug_enter("untagged cmd completed");
   4070 	}
   4071 #endif
   4072 
   4073 
   4074 #ifdef	ESPDEBUG
   4075 	if (esp_test_stop && (sp->cmd_pkt.pkt_statistics & STAT_PERR)) {
   4076 		debug_enter("parity errors");
   4077 	}
   4078 
   4079 	if (DEBUGGING) {
   4080 		eprintf(esp, "%d.%d; cmds=%d disc=%d lastmsg 0x%x\n",
   4081 		    Tgt(sp), Lun(sp), esp->e_ncmds, esp->e_ndisc,
   4082 		    esp->e_last_msgin);
   4083 		eprintf(esp, "\treason '%s'; cmd state 0x%b\n",
   4084 		    scsi_rname(sp->cmd_pkt.pkt_reason),
   4085 		    sp->cmd_pkt.pkt_state, scsi_state_bits);
   4086 	}
   4087 #endif	/* ESPDEBUG */
   4088 
   4089 	if (status->sts_chk) {
   4090 		/*
   4091 		 * In the case that we are getting a check condition
   4092 		 * clear our knowledge of synchronous capabilities.
   4093 		 * This will unambiguously force a renegotiation
   4094 		 * prior to any possible data transfer (we hope),
   4095 		 * including the data transfer for a UNIT ATTENTION
   4096 		 * condition generated by somebody powering on and
   4097 		 * off a target.
   4098 		 * Note: only renegotiate if we were running sync mode
   4099 		 * with this target
   4100 		 */
   4101 		if (esp->e_offset[Tgt(sp)] != 0) {
   4102 			esp->e_sync_known &= ~(1<<Tgt(sp));
   4103 		}
   4104 	}
   4105 
   4106 	/*
   4107 	 * backoff sync if there were parity errors
   4108 	 */
   4109 	if (sp->cmd_pkt.pkt_statistics & STAT_PERR) {
   4110 		esp_sync_backoff(esp, sp, last_slot);
   4111 	}
   4112 
   4113 	/*
   4114 	 * go to state free and try to start a new cmd now
   4115 	 * don't start the next cmd if the current cmd was a RQSENSE; this
   4116 	 * will give the target driver a chance to do some recovery
   4117 	 */
   4118 	New_state(esp, STATE_FREE);
   4119 
   4120 	esp->e_slots[last_slot] = NULL;
   4121 
   4122 	/*
   4123 	 * Free tagged slot
   4124 	 */
   4125 	esp_remove_tagged_cmd(esp, sp, last_slot, NEW_TIMEOUT);
   4126 
   4127 	if ((esp->e_ncmds > esp->e_ndisc) && (*((char *)status) == 0) &&
   4128 	    (*(sp->cmd_pkt.pkt_cdbp) != SCMD_REQUEST_SENSE)) {
   4129 		if (esp_ustart(esp, esp->e_last_slot, NEW_CMD)) {
   4130 			/*
   4131 			 * we used to always set action to ACTION_RETURN
   4132 			 * this leaves a small window where the
   4133 			 * ready queue is non-empty
   4134 			 * and doesn't get started
   4135 			 */
   4136 			action = ACTION_RETURN;
   4137 		}
   4138 	}
   4139 
   4140 #ifdef ESP_TEST_RQSENSE
   4141 	if ((esp_test_rqsense & (1 << Tgt(sp))) &&
   4142 	    (*(sp->cmd_pkt.pkt_cdbp) != SCMD_REQUEST_SENSE)) {
   4143 		status->sts_chk = 1;
   4144 		esp->e_sync_known &= ~(1<<Tgt(sp));
   4145 		esp_test_rqsense = 0;
   4146 	}
   4147 #endif
   4148 #ifdef ESPDEBUG
   4149 	if ((sp->cmd_pkt.pkt_state & STATE_GOT_STATUS) && (espdebug > 1) &&
   4150 	    (status->sts_chk) && (sp->cmd_pkt.pkt_flags & FLAG_TAGMASK)) {
   4151 		debug_enter("esp_finish with check condition");
   4152 	}
   4153 #endif
   4154 
   4155 	if (sp->cmd_pkt.pkt_state & STATE_XFERRED_DATA) {
   4156 		sp->cmd_pkt.pkt_resid = sp->cmd_dmacount - sp->cmd_data_count;
   4157 		if (sp->cmd_flags & CFLAG_CMDIOPB) {
   4158 			(void) ddi_dma_sync(sp->cmd_dmahandle, 0, (uint_t)-1,
   4159 			    DDI_DMA_SYNC_FORCPU);
   4160 		}
   4161 #ifdef	ESPDEBUG
   4162 		if ((espdebug > 1) && (sp->cmd_pkt.pkt_resid)) {
   4163 			eprintf(esp, "%d.%d finishes with %ld resid\n",
   4164 			    Tgt(sp), Lun(sp), sp->cmd_pkt.pkt_resid);
   4165 		}
   4166 #endif	/* ESPDEBUG */
   4167 	}
   4168 
   4169 #ifdef ESP_KSTATS
   4170 	/*
   4171 	 * update kstats
   4172 	 */
   4173 	if (esp_do_kstats && esp->e_slot_stats[last_slot]) {
   4174 		if (sp->cmd_flags & CFLAG_DMAVALID) {
   4175 			if (sp->cmd_flags & CFLAG_DMASEND) {
   4176 				IOSP(last_slot)->writes++;
   4177 				IOSP(last_slot)->nwritten += sp->cmd_data_count;
   4178 			} else {
   4179 				IOSP(last_slot)->reads++;
   4180 				IOSP(last_slot)->nread += sp->cmd_data_count;
   4181 			}
   4182 		}
   4183 		kstat_runq_exit(IOSP(last_slot));
   4184 	}
   4185 #endif /* ESP_KSTATS */
   4186 
   4187 
   4188 	/*
   4189 	 * NO_INTR pkts shouldn't have a pkt_comp callback
   4190 	 * but we call esp_call_pkt_comp() just to clean up
   4191 	 */
   4192 	if (sp->cmd_pkt.pkt_flags & FLAG_NOINTR) {
   4193 		esp_call_pkt_comp(esp, sp);
   4194 		action = ACTION_RETURN;
   4195 
   4196 	} else if ((*sp->cmd_scbp & STATUS_MASK) == STATUS_QFULL) {
   4197 		esp_handle_qfull(esp, sp, last_slot);
   4198 	} else {
   4199 		/*
   4200 		 * start an autorequest sense if there was a check condition
   4201 		 */
   4202 		if (status->sts_chk &&
   4203 		    (sp->cmd_scblen >= sizeof (struct scsi_arq_status))) {
   4204 			if (esp_start_arq_pkt(esp, sp)) {
   4205 				/*
   4206 				 * auto request sense failed
   4207 				 * let the target driver handle it
   4208 				 */
   4209 				esp_call_pkt_comp(esp, sp);
   4210 			} else {
   4211 				action = ACTION_RETURN;
   4212 			}
   4213 		} else {
   4214 			esp_call_pkt_comp(esp, sp);
   4215 		}
   4216 	}
   4217 
   4218 	TRACE_0(TR_FAC_SCSI, TR_ESP_FINISH_END, "esp_finish_end");
   4219 	return (action);
   4220 }
   4221 
   4222 /*
   4223  * Request sense commands are priority commands and can't get
   4224  * QFULL condition.
   4225  */
   4226 static void
   4227 esp_handle_qfull(struct esp *esp, struct esp_cmd *sp, int slot)
   4228 {
   4229 	if ((++sp->cmd_qfull_retries > esp->e_qfull_retries[Tgt(sp)]) ||
   4230 	    (esp->e_qfull_retries[Tgt(sp)] == 0)) {
   4231 		/*
   4232 		 * We have exhausted the retries on QFULL, or,
   4233 		 * the target driver has indicated that it
   4234 		 * wants to handle QFULL itself by setting
   4235 		 * qfull-retries capability to 0. In either case
   4236 		 * we want the target driver's QFULL handling
   4237 		 * to kick in. We do this by having pkt_reason
   4238 		 * as CMD_CMPLT and pkt_scbp as STATUS_QFULL.
   4239 		 */
   4240 		IPRINTF2("%d.%d: status queue full, retries over\n",
   4241 		    Tgt(sp), Lun(sp));
   4242 		esp_set_all_lun_throttles(esp, slot, DRAIN_THROTTLE);
   4243 		esp_call_pkt_comp(esp, sp);
   4244 	} else {
   4245 		if (esp->e_reset_delay[Tgt(sp)] == 0) {
   4246 			esp->e_throttle[slot] =
   4247 			    max((esp->e_tcmds[slot] - 2), 0);
   4248 		}
   4249 		IPRINTF3("%d.%d: status queue full, new throttle = %d, "
   4250 		    "retrying\n", Tgt(sp), Lun(sp), esp->e_throttle[slot]);
   4251 		sp->cmd_pkt.pkt_flags |= FLAG_HEAD;
   4252 		sp->cmd_flags &= ~CFLAG_TRANFLAG;
   4253 		(void) _esp_start(esp, sp, NO_TRAN_BUSY);
   4254 		if (esp->e_throttle[slot] == HOLD_THROTTLE) {
   4255 			/*
   4256 			 * By setting throttle to QFULL_THROTTLE, we
   4257 			 * avoid submitting new commands and in
   4258 			 * esp_restart_cmd find out slots which need
   4259 			 * their throttles to be cleared.
   4260 			 */
   4261 			esp_set_all_lun_throttles(esp, slot, QFULL_THROTTLE);
   4262 			mutex_enter(&esp_global_mutex);
   4263 			if ((esp->e_restart_cmd_timeid == 0) && ESP_CAN_SCHED) {
   4264 				esp->e_restart_cmd_timeid =
   4265 				    timeout(esp_restart_cmd, esp,
   4266 				    esp->e_qfull_retry_interval[Tgt(sp)]);
   4267 			}
   4268 			mutex_exit(&esp_global_mutex);
   4269 		}
   4270 	}
   4271 }
   4272 
   4273 static void
   4274 esp_restart_cmd(void *esp_arg)
   4275 {
   4276 	struct esp *esp = esp_arg;
   4277 	int i;
   4278 
   4279 	IPRINTF("esp_restart_cmd:\n");
   4280 
   4281 	mutex_enter(ESP_MUTEX);
   4282 	esp->e_restart_cmd_timeid = 0;
   4283 
   4284 	for (i = 0; i < N_SLOTS; i += NLUNS_PER_TARGET) {
   4285 		if (esp->e_reset_delay[i/NLUNS_PER_TARGET]) {
   4286 			continue;
   4287 		}
   4288 		if (esp->e_throttle[i] == QFULL_THROTTLE) {
   4289 			esp_set_all_lun_throttles(esp, i, CLEAR_THROTTLE);
   4290 		}
   4291 	}
   4292 
   4293 	(void) esp_istart(esp);
   4294 	mutex_exit(ESP_MUTEX);
   4295 }
   4296 
   4297 #ifdef ESP_CHECK
   4298 /*
   4299  * this function checks whether a cmd is already queued
   4300  * and also checks the counts (which are not always accurate but
   4301  * usually on completion of the error recovery are OK again
   4302  */
   4303 static int esp_do_check = 0;
   4304 
   4305 static void
   4306 esp_check_in_transport(struct esp *esp, struct esp_cmd *sp)
   4307 {
   4308 	struct callback_info *cb_info = esp->e_callback_info;
   4309 	struct esp_cmd *qsp;
   4310 	int ncmds, ndiscs, i, slot;
   4311 
   4312 	if (sp) {
   4313 		slot = Tgt(sp) * NLUNS_PER_TARGET | Lun(sp);
   4314 
   4315 		ASSERT(sp != esp->e_slots[slot]);
   4316 		if (esp->e_tagQ[slot] != NULL) {
   4317 			for (i = 0; i < NTAGS; i++) {
   4318 				ASSERT(sp != esp->e_tagQ[slot]->t_slot[i]);
   4319 			}
   4320 		}
   4321 
   4322 		mutex_enter(&cb_info->c_mutex);
   4323 		qsp = cb_info->c_qf;
   4324 
   4325 		while (qsp) {
   4326 			ASSERT(sp != qsp);
   4327 			qsp = qsp->cmd_forw;
   4328 		}
   4329 		mutex_exit(&cb_info->c_mutex);
   4330 
   4331 		/*
   4332 		 * command has not been started yet and is still
   4333 		 * in the ready queue
   4334 		 */
   4335 
   4336 		if (esp->e_readyf[slot]) {
   4337 			for (qsp = esp->e_readyf[slot]; qsp != NULL;
   4338 			    qsp = qsp->cmd_forw) {
   4339 				ASSERT(qsp != sp);
   4340 				ASSERT((qsp->cmd_flags & CFLAG_COMPLETED)
   4341 				    == 0);
   4342 				ASSERT((qsp->cmd_flags & CFLAG_FREE) == 0);
   4343 				ASSERT((qsp->cmd_flags & CFLAG_FINISHED)
   4344 				    == 0);
   4345 				ASSERT((qsp->cmd_flags & CFLAG_CMDDISC) == 0);
   4346 			}
   4347 		}
   4348 	}
   4349 
   4350 	/* count the number of cmds */
   4351 	ncmds = ndiscs = 0;
   4352 	for (slot = 0; slot < N_SLOTS; slot++) {
   4353 		if (esp->e_slots[slot]) {
   4354 			ncmds++;
   4355 			if ((esp->e_slots[slot])->cmd_flags & CFLAG_CMDDISC) {
   4356 				ndiscs++;
   4357 			}
   4358 		}
   4359 
   4360 		for (qsp = esp->e_readyf[slot]; qsp != NULL;
   4361 		    qsp = qsp->cmd_forw) {
   4362 			if (qsp) {
   4363 				ncmds++;
   4364 				ASSERT((qsp->cmd_flags & CFLAG_COMPLETED)
   4365 				    == 0);
   4366 				ASSERT((qsp->cmd_flags & CFLAG_FREE) == 0);
   4367 				ASSERT((qsp->cmd_flags & CFLAG_FINISHED)
   4368 				    == 0);
   4369 			}
   4370 		}
   4371 
   4372 		if (esp->e_tagQ[slot] != NULL) {
   4373 			for (i = 0; i < NTAGS; i++) {
   4374 				if ((esp->e_tagQ[slot]->t_slot[i] != NULL) &&
   4375 				    (esp->e_tagQ[slot]->t_slot[i] !=
   4376 				    esp->e_slots[slot])) {
   4377 					ncmds++;
   4378 					qsp = esp->e_tagQ[slot]->t_slot[i];
   4379 					if (qsp->cmd_flags & CFLAG_CMDDISC) {
   4380 						ndiscs++;
   4381 					}
   4382 					ASSERT((qsp->cmd_flags &
   4383 					    CFLAG_COMPLETED) == 0);
   4384 					ASSERT((qsp->cmd_flags & CFLAG_FREE)
   4385 					    == 0);
   4386 					ASSERT((qsp->cmd_flags &
   4387 					    CFLAG_FINISHED) == 0);
   4388 				}
   4389 			}
   4390 		}
   4391 	}
   4392 
   4393 	if ((ncmds != esp->e_ncmds) || (ndiscs != esp->e_ndisc)) {
   4394 		if (esp_do_check)
   4395 			debug_enter("ncmds problem");
   4396 		eprintf(esp, "ncmds = %d, %d, ndisc = %d, %d\n",
   4397 		    ncmds, esp->e_ncmds, ndiscs, esp->e_ndisc);
   4398 	}
   4399 }
   4400 #endif
   4401 
   4402 /*
   4403  * esp_call_pkt_comp does sanity checking to ensure that we don't
   4404  * call completion twice on the same packet or a packet that has been freed.
   4405  * if there is a completion function specified, the packet is queued
   4406  * up and it is left to the esp_callback thread to empty the queue at
   4407  * a lower priority; note that there is one callback queue per esp
   4408  *
   4409  * we use a separate thread for calling back into the target driver
   4410  * this thread unqueues packets from the callback queue
   4411  */
   4412 static void
   4413 esp_call_pkt_comp(struct esp *esp, struct esp_cmd *sp)
   4414 {
   4415 	TRACE_0(TR_FAC_SCSI, TR_ESP_CALL_PKT_COMP_START,
   4416 	    "esp_call_pkt_comp_start");
   4417 	ASSERT(sp != 0);
   4418 	ASSERT((sp->cmd_flags & CFLAG_COMPLETED) == 0);
   4419 	ASSERT((sp->cmd_flags & CFLAG_FREE) == 0);
   4420 	ASSERT(esp->e_ncmds >= esp->e_ndisc);
   4421 
   4422 	esp_check_in_transport(esp, sp);
   4423 
   4424 	sp->cmd_flags &= ~CFLAG_IN_TRANSPORT;
   4425 	sp->cmd_flags |= CFLAG_COMPLETED;
   4426 	sp->cmd_qfull_retries = 0;
   4427 
   4428 
   4429 	/*
   4430 	 * if there is a completion function and this is not an arq pkt
   4431 	 * or immediate callback pkt then queue up the callback
   4432 	 */
   4433 	if (sp->cmd_pkt.pkt_comp && !(sp->cmd_flags & CFLAG_CMDARQ) &&
   4434 	    !(sp->cmd_pkt.pkt_flags & FLAG_IMMEDIATE_CB)) {
   4435 		struct callback_info *cb_info = esp->e_callback_info;
   4436 
   4437 		if (sp->cmd_pkt.pkt_reason != CMD_CMPLT) {
   4438 			IPRINTF6("completion for %d.%d, sp=0x%p, "
   4439 			    "reason=%s, stats=%x, state=%x\n",
   4440 			    Tgt(sp), Lun(sp), (void *)sp,
   4441 			    scsi_rname(sp->cmd_pkt.pkt_reason),
   4442 			    sp->cmd_pkt.pkt_statistics,
   4443 			    sp->cmd_pkt.pkt_state);
   4444 		} else {
   4445 			EPRINTF2("completion queued for %d.%d\n",
   4446 			    Tgt(sp), Lun(sp));
   4447 		}
   4448 
   4449 		/*
   4450 		 * append the packet or start a new queue
   4451 		 */
   4452 		mutex_enter(&cb_info->c_mutex);
   4453 		if (cb_info->c_qf) {
   4454 			/*
   4455 			 * add to tail
   4456 			 */
   4457 			struct esp_cmd *dp = cb_info->c_qb;
   4458 			ASSERT(dp != NULL);
   4459 			cb_info->c_qb = sp;
   4460 			sp->cmd_forw = NULL;
   4461 			dp->cmd_forw = sp;
   4462 		} else {
   4463 			/*
   4464 			 * start new queue
   4465 			 */
   4466 			cb_info->c_qf = cb_info->c_qb = sp;
   4467 			sp->cmd_forw = NULL;
   4468 		}
   4469 		cb_info->c_qlen++;
   4470 		esp->e_callback_signal_needed = cb_info->c_signal_needed = 1;
   4471 		mutex_exit(&cb_info->c_mutex);
   4472 
   4473 	} else if ((sp->cmd_flags & CFLAG_CMDARQ) && sp->cmd_pkt.pkt_comp) {
   4474 		/*
   4475 		 * pkt_comp may be NULL when we are aborting/resetting but then
   4476 		 * the callback will be redone later
   4477 		 */
   4478 		int slot = Tgt(sp) * NLUNS_PER_TARGET | Lun(sp);
   4479 		/*
   4480 		 * this recurses!
   4481 		 */
   4482 		esp_complete_arq_pkt(esp, sp, slot);
   4483 
   4484 	} else if ((sp->cmd_pkt.pkt_flags & FLAG_IMMEDIATE_CB) &&
   4485 	    sp->cmd_pkt.pkt_comp) {
   4486 		mutex_exit(ESP_MUTEX);
   4487 		(*sp->cmd_pkt.pkt_comp)(&sp->cmd_pkt);
   4488 		mutex_enter(ESP_MUTEX);
   4489 	} else {
   4490 		EPRINTF2("No completion routine for 0x%p reason %x\n",
   4491 		    (void *)sp, sp->cmd_pkt.pkt_reason);
   4492 	}
   4493 	TRACE_0(TR_FAC_SCSI, TR_ESP_CALL_PKT_COMP_END,
   4494 	    "esp_call_pkt_comp_end");
   4495 }
   4496 
   4497 /*
   4498  * Complete the process of selecting a target
   4499  */
   4500 static int
   4501 esp_finish_select(struct esp *esp)
   4502 {
   4503 	volatile struct espreg *ep = esp->e_reg;
   4504 	volatile struct dmaga *dmar = esp->e_dma;
   4505 	struct esp_cmd *sp = CURRENT_CMD(esp);
   4506 	int cmdamt, fifoamt;
   4507 	uchar_t intr = esp->e_intr;
   4508 	uchar_t step;
   4509 	ushort_t state = esp->e_state;
   4510 	int target;
   4511 
   4512 	TRACE_0(TR_FAC_SCSI, TR_ESP_FINISH_SELECT_START,
   4513 	    "esp_finish_select_start");
   4514 	EPRINTF("esp_finish_select:\n");
   4515 	step = esp->e_step = (ep->esp_step & ESP_STEP_MASK);
   4516 
   4517 	ASSERT(esp->e_cur_slot != UNDEFINED);
   4518 
   4519 	if (sp == NULL) {
   4520 		/*
   4521 		 * this shouldn't happen but sometimes does after a
   4522 		 * device reset
   4523 		 */
   4524 		esplog(esp, CE_WARN, "bad selection");
   4525 		return (ACTION_RESET);
   4526 	}
   4527 
   4528 	target = Tgt(sp);
   4529 
   4530 	ASSERT(esp->e_cur_slot == ((Tgt(sp) * NLUNS_PER_TARGET) | Lun(sp)));
   4531 
   4532 	/*
   4533 	 * Check for DMA gate array errors
   4534 	 */
   4535 	if ((esp->e_dmaga_csr = dmar->dmaga_csr) & DMAGA_ERRPEND) {
   4536 		/*
   4537 		 * It would be desirable to set the ATN* line and attempt to
   4538 		 * do the whole schmear of INITIATOR DETECTED ERROR here,
   4539 		 * but that is too hard to do at present.
   4540 		 */
   4541 		esplog(esp, CE_WARN,
   4542 		    "Unrecoverable DMA error during selection");
   4543 		if (sp->cmd_pkt.pkt_reason == CMD_CMPLT)
   4544 			sp->cmd_pkt.pkt_reason = CMD_TRAN_ERR;
   4545 		TRACE_0(TR_FAC_SCSI, TR_ESP_FINISH_SELECT_RESET1_END,
   4546 		    "esp_finish_select_end (ACTION_RESET1)");
   4547 		return (ACTION_RESET);
   4548 	}
   4549 
   4550 	/*
   4551 	 * Latch up fifo count
   4552 	 */
   4553 	fifoamt = FIFO_CNT(ep);
   4554 
   4555 	/*
   4556 	 * How far did we go (by the DMA gate array's reckoning)?
   4557 	 */
   4558 	cmdamt = dmar->dmaga_addr - esp->e_lastdma;
   4559 
   4560 	/*
   4561 	 * If the NEXTBYTE value is non-zero (and we have the
   4562 	 * rev 1 DMA gate array), we went one longword further
   4563 	 * less 4 minus the NEXTBYTE value....
   4564 	 */
   4565 	if (ESP_DMAGA_REV(esp) == DMA_REV1) {
   4566 		int i;
   4567 		if ((i = DMAGA_NEXTBYTE(dmar)) != 0) {
   4568 			cmdamt -= (4-i);
   4569 		}
   4570 	}
   4571 
   4572 	/*
   4573 	 * Shut off DMA gate array
   4574 	 */
   4575 	ESP_FLUSH_DMA(esp);
   4576 
   4577 	/*
   4578 	 * Now adjust cmdamt by the amount of data left in the fifo
   4579 	 */
   4580 	cmdamt -= fifoamt;
   4581 
   4582 	/*
   4583 	 * Be a bit defensive...
   4584 	 */
   4585 	if (cmdamt < 0 || cmdamt > FIFOSIZE) {
   4586 		cmdamt = 0;
   4587 	}
   4588 
   4589 #ifdef	ESPDEBUG
   4590 	if (DEBUGGING) {
   4591 		eprintf(esp,
   4592 		    "finsel: state %s, step %d; did %d of %d; fifo %d\n",
   4593 		    esp_state_name(state), step, cmdamt,
   4594 		    esp->e_lastcount, fifoamt);
   4595 		esp_stat_int_print(esp);
   4596 	}
   4597 #endif	/* ESPDEBUG */
   4598 
   4599 	/*
   4600 	 * Did something respond to selection?
   4601 	 */
   4602 	if (intr == (ESP_INT_BUS|ESP_INT_FCMP)) {
   4603 		/*
   4604 		 * We successfully selected a target (we think).
   4605 		 * Now we figure out how botched things are
   4606 		 * based upon the kind of selection we were
   4607 		 * doing and the state of the step register.
   4608 		 */
   4609 
   4610 		switch (step) {
   4611 		case ESP_STEP_ARBSEL:
   4612 			/*
   4613 			 * In this case, we selected the target, but went
   4614 			 * neither into MESSAGE OUT nor COMMAND phase.
   4615 			 * However, this isn't a fatal error, so we just
   4616 			 * drive on.
   4617 			 *
   4618 			 * This might be a good point to note that we have
   4619 			 * a target that appears to not accommodate
   4620 			 * disconnecting,
   4621 			 * but it really isn't worth the effort to distinguish
   4622 			 * such targets especially from others.
   4623 			 */
   4624 			/* FALLTHROUGH */
   4625 
   4626 		case ESP_STEP_SENTID:
   4627 			/*
   4628 			 * In this case, we selected the target and sent
   4629 			 * message byte and have stopped with ATN* still on.
   4630 			 * This case should only occur if we use the SELECT
   4631 			 * AND STOP command.
   4632 			 */
   4633 			/* FALLTHROUGH */
   4634 
   4635 		case ESP_STEP_NOTCMD:
   4636 			/*
   4637 			 * In this case, we either didn't transition to command
   4638 			 * phase, or,
   4639 			 * if we were using the SELECT WITH ATN3 command,
   4640 			 * we possibly didn't send all message bytes.
   4641 			 */
   4642 			cmdamt = 0;
   4643 			break;
   4644 
   4645 		case ESP_STEP_PCMD:
   4646 			/*
   4647 			 * In this case, not all command bytes transferred.
   4648 			 */
   4649 			/* FALLTHROUGH */
   4650 
   4651 		case ESP_STEP_DONE:
   4652 step_done:
   4653 			/*
   4654 			 * This is the usual 'good' completion point.
   4655 			 * If we we sent message byte(s), we subtract
   4656 			 * off the number of message bytes that were
   4657 			 * ahead of the command.
   4658 			 */
   4659 			sp->cmd_pkt.pkt_state |= STATE_SENT_CMD;
   4660 			if (state == STATE_SELECT_NORMAL)
   4661 				cmdamt -= 1;
   4662 			break;
   4663 
   4664 		case ESP_STEP_DONE5:
   4665 		case ESP_STEP_DONE6:
   4666 		case ESP_STEP_DONE7:
   4667 			/*
   4668 			 * this happens on some sun4m boards; probably a hw bug
   4669 			 */
   4670 			if ((esp->e_options & ESP_OPT_ACCEPT_STEP567)) {
   4671 				goto step_done;
   4672 			}
   4673 			/* FALLTHROUGH */
   4674 
   4675 		default:
   4676 			esplog(esp, CE_WARN,
   4677 			    "bad sequence step (0x%x) in selection", step);
   4678 			TRACE_0(TR_FAC_SCSI, TR_ESP_FINISH_SELECT_RESET3_END,
   4679 			    "esp_finish_select_end (ACTION_RESET3)");
   4680 			return (ACTION_RESET);
   4681 		}
   4682 
   4683 		if ((esp->e_options & ESP_OPT_FAS) == 0) {
   4684 			/*
   4685 			 * If we sent any messages or sent a command, as
   4686 			 * per ESP errata sheets, we have to hit the
   4687 			 * chip with a CMD_NOP in order to unlatch the
   4688 			 * fifo counter.
   4689 			 */
   4690 			Esp_cmd(esp, CMD_NOP);
   4691 
   4692 			/*
   4693 			 * *Carefully* dump out any cruft left in the fifo.
   4694 			 * If this target has shifted to synchronous DATA IN
   4695 			 * phase, then the ESP has already flushed the fifo
   4696 			 * for us.
   4697 			 */
   4698 			if (fifoamt != 0 &&
   4699 			    ((esp->e_stat & ESP_PHASE_MASK) !=
   4700 			    ESP_PHASE_DATA_IN ||
   4701 			    esp->e_offset[target] == 0)) {
   4702 				esp_flush_fifo(esp);
   4703 			}
   4704 		}
   4705 
   4706 		/*
   4707 		 * OR in common state...
   4708 		 */
   4709 		sp->cmd_pkt.pkt_state |= (STATE_GOT_BUS|STATE_GOT_TARGET);
   4710 
   4711 		/*
   4712 		 * advance command pointer
   4713 		 */
   4714 		if (cmdamt > 0) {
   4715 			sp->cmd_pkt.pkt_state |= STATE_SENT_CMD;
   4716 			sp->cmd_cdbp = (uchar_t *)sp->cmd_cdbp + cmdamt;
   4717 		}
   4718 
   4719 		/*
   4720 		 * data pointer initialization has already been done
   4721 		 */
   4722 		New_state(esp, ACTS_UNKNOWN);
   4723 		TRACE_0(TR_FAC_SCSI, TR_ESP_FINISH_SELECT_ACTION3_END,
   4724 		    "esp_finish_select_end (action3)");
   4725 		return (esp_handle_unknown(esp));
   4726 
   4727 	} else if (intr == ESP_INT_DISCON) {
   4728 		/*
   4729 		 * This takes care of getting the bus, but no
   4730 		 * target responding to selection. Clean up the
   4731 		 * chip state.
   4732 		 */
   4733 		esp_chip_disconnect(esp, sp);
   4734 
   4735 		/*
   4736 		 * There is a definite problem where the MT02
   4737 		 * drops BSY if you use the SELECT && STOP command,
   4738 		 * which leaves ATN asserted after sending an identify
   4739 		 * message.
   4740 		 */
   4741 		if (step != 0 &&
   4742 		    (state == STATE_SELECT_N_SENDMSG ||
   4743 		    state == STATE_SELECT_N_TAG ||
   4744 		    state == STATE_SELECT_N_STOP)) {
   4745 
   4746 			if ((state == STATE_SELECT_N_SENDMSG ||
   4747 			    (state == STATE_SELECT_N_STOP)) &&
   4748 			    esp->e_cur_msgout[0] == MSG_EXTENDED) {
   4749 				int slot = esp->e_cur_slot;
   4750 
   4751 				IPRINTF("esp_finish_sel:  sync neg. failed\n");
   4752 				esp->e_sync_known |= (1<<target);
   4753 				esp->e_weak |= (1<<target);
   4754 				New_state(esp, STATE_FREE);
   4755 				if ((sp->cmd_flags & CFLAG_CMDPROXY) == 0) {
   4756 
   4757 					/*
   4758 					 * Rerun the command again.
   4759 					 * if not a proxy cmd
   4760 					 */
   4761 #ifdef ESP_KSTATS
   4762 					/*
   4763 					 * update kstats
   4764 					 */
   4765 					if (esp_do_kstats &&
   4766 					    esp->e_slot_stats[slot]) {
   4767 						kstat_runq_back_to_waitq(
   4768 						    IOSP(slot));
   4769 					}
   4770 #endif /* ESP_KSTATS */
   4771 					(void) esp_ustart(esp, slot, SAME_CMD);
   4772 					TRACE_0(TR_FAC_SCSI,
   4773 					    TR_ESP_FINISH_SELECT_RETURN1_END,
   4774 					    "esp_finish_select_end (RETURN1)");
   4775 					return (ACTION_RETURN);
   4776 				}
   4777 
   4778 			} else if (esp->e_state == STATE_SELECT_N_TAG) {
   4779 				int slot = esp->e_cur_slot;
   4780 				/*
   4781 				 * target rejected tag and dropped off the
   4782 				 * bus
   4783 				 * clear tag slot and tag
   4784 				 */
   4785 				IPRINTF("esp_finish_sel: tag asking failed\n");
   4786 
   4787 				esp_remove_tagged_cmd(esp, sp, slot, 0);
   4788 				esp->e_notag |= (1<<target);
   4789 				sp->cmd_pkt.pkt_flags &=  ~FLAG_TAGMASK;
   4790 
   4791 				/*
   4792 				 * Rerun the command again.
   4793 				 */
   4794 #ifdef ESP_KSTATS
   4795 				/*
   4796 				 * update kstats
   4797 				 */
   4798 				if (esp_do_kstats &&
   4799 				    esp->e_slot_stats[slot]) {
   4800 					kstat_runq_back_to_waitq(IOSP(slot));
   4801 				}
   4802 #endif /* ESP_KSTATS */
   4803 				New_state(esp, STATE_FREE);
   4804 
   4805 				/* esp_runpoll() will retry nointr cmds */
   4806 				if ((sp->cmd_pkt.pkt_flags &
   4807 				    FLAG_NOINTR) == 0) {
   4808 					(void) esp_ustart(esp, slot, SAME_CMD);
   4809 				}
   4810 
   4811 				TRACE_0(TR_FAC_SCSI,
   4812 				    TR_ESP_FINISH_SELECT_RETURN2_END,
   4813 				    "esp_finish_select_end (ACTION_RETURN2)");
   4814 				return (ACTION_RETURN);
   4815 			}
   4816 		}
   4817 
   4818 		sp->cmd_pkt.pkt_state |= STATE_GOT_BUS;
   4819 		if (sp->cmd_pkt.pkt_reason == CMD_CMPLT)
   4820 			sp->cmd_pkt.pkt_reason = CMD_INCOMPLETE;
   4821 		TRACE_0(TR_FAC_SCSI, TR_ESP_FINISH_SELECT_FINISH_END,
   4822 		    "esp_finish_select_end (ACTION_FINISH)");
   4823 		return (ACTION_FINISH);
   4824 
   4825 	} else if (intr == (ESP_INT_FCMP|ESP_INT_RESEL)) {
   4826 		/*
   4827 		 * A reselection attempt glotzed our selection attempt.
   4828 		 * If we were running w/o checking parity on this
   4829 		 * command, restore parity checking.
   4830 		 * we put request back in the ready queue
   4831 		 */
   4832 		int slot;
   4833 		struct esp_cmd *dp;
   4834 
   4835 		slot = esp->e_cur_slot;
   4836 #ifdef ESP_KSTATS
   4837 		if (esp_do_kstats && esp->e_slot_stats[slot]) {
   4838 			kstat_runq_back_to_waitq(IOSP(slot));
   4839 		}
   4840 #endif /* ESP_KSTATS */
   4841 		ESP_PREEMPT(esp);
   4842 		LOG_STATE(esp, ACTS_PREEMPTED, esp->e_stat, 0, -1);
   4843 		if ((sp->cmd_flags & CFLAG_CMDPROXY) == 0) {
   4844 			esp->e_slots[slot] = (struct esp_cmd *)NULL;
   4845 			esp_remove_tagged_cmd(esp, sp, slot, 0);
   4846 		}
   4847 		if (sp->cmd_pkt.pkt_flags & FLAG_NOINTR) {
   4848 			/*
   4849 			 * runpoll will try again so no need to put it
   4850 			 * on ready Q
   4851 			 */
   4852 			TRACE_0(TR_FAC_SCSI, TR_ESP_FINISH_SELECT_ACTION1_END,
   4853 			    "esp_finish_select_end (action1)");
   4854 			return (esp_reconnect(esp));
   4855 		}
   4856 
   4857 		dp = esp->e_readyf[slot];
   4858 		esp->e_readyf[slot] = sp;
   4859 		sp->cmd_forw = dp;
   4860 		if (esp->e_readyb[slot] == NULL) {
   4861 			esp->e_readyb[slot] = sp;
   4862 		}
   4863 		if ((esp->e_target_scsi_options[target] &
   4864 		    SCSI_OPTIONS_PARITY) &&
   4865 		    (sp->cmd_pkt.pkt_flags & FLAG_NOPARITY)) {
   4866 			ep->esp_conf = esp->e_espconf;
   4867 		}
   4868 		TRACE_0(TR_FAC_SCSI, TR_ESP_FINISH_SELECT_ACTION2_END,
   4869 		    "esp_finish_select_end (action2)");
   4870 		return (esp_reconnect(esp));
   4871 
   4872 	} else if (intr != (ESP_INT_BUS|ESP_INT_FCMP)) {
   4873 		esplog(esp, CE_WARN, "undetermined selection failure");
   4874 #ifdef ESPDEBUG
   4875 		esp_stat_int_print(esp);
   4876 #endif
   4877 		TRACE_0(TR_FAC_SCSI, TR_ESP_FINISH_SELECT_RESET2_END,
   4878 		    "esp_finish_select_end (ACTION_RESET2)");
   4879 		return (ACTION_RESET);
   4880 	}
   4881 	_NOTE(NOT_REACHED)
   4882 	/* NOTREACHED */
   4883 	return (ACTION_FINSEL);
   4884 }
   4885 
   4886 /*
   4887  * Handle the reconnection of a target
   4888  */
   4889 static char *botched_tag =
   4890 	"Target %d.%d botched tagged queuing msg (0x%x, 0x%x)";
   4891 
   4892 /*
   4893  * Identify msg. to target number conversion table.
   4894  * Note, id's > 64 are multi-bit and thus invalid so we don't
   4895  * need bigger table.
   4896  */
   4897 static char scsi_targetid[] = {
   4898 /*	 0   1	 2   3	 4   5	 6   7	 8   9	 a   b	 c   d	 e   f */
   4899 	-1,  0,	 1, -1,	 2, -1, -1, -1,	 3, -1, -1, -1, -1, -1, -1, -1,
   4900 	04, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1,
   4901 	05, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1,
   4902 	-1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1,
   4903 	06, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1,
   4904 	-1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1,
   4905 	-1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1,
   4906 	-1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1,
   4907 	7
   4908 };
   4909 
   4910 static int
   4911 esp_reconnect(struct esp *esp)
   4912 {
   4913 	volatile struct espreg *ep = esp->e_reg;
   4914 	struct esp_cmd *sp;
   4915 	char target, lun;
   4916 	uchar_t tmp, myid = (1<<MY_ID(esp));
   4917 	short slot = -1;
   4918 	uchar_t period, offset, conf3;
   4919 	int msg_accept_issued = 0;
   4920 	char *bad_reselect = NULL;
   4921 
   4922 	TRACE_0(TR_FAC_SCSI, TR_ESP_RECONNECT_START,
   4923 	    "esp_reconnect_start");
   4924 	EPRINTF("esp_reconnect:\n");
   4925 
   4926 	switch (esp->e_state) {
   4927 	default:
   4928 		/*
   4929 		 * normal initial reconnect; we get another interrupt later
   4930 		 * for the tag
   4931 		 */
   4932 		New_state(esp, ACTS_RESEL);
   4933 
   4934 		/*
   4935 		 * Pick up target id from fifo
   4936 		 *
   4937 		 * There should only be the reselecting target's id
   4938 		 * and an identify message in the fifo.
   4939 		 */
   4940 		if (FIFO_CNT(ep) != 2) {
   4941 			bad_reselect = "bad reselect bytes";
   4942 			goto bad;
   4943 		}
   4944 
   4945 		tmp = ep->esp_fifo_data;
   4946 
   4947 		if ((tmp & myid) == 0) {
   4948 			/*
   4949 			 * Our SCSI id is missing. This 'cannot happen'.
   4950 			 */
   4951 			bad_reselect = "scsi id is missing";
   4952 			goto bad;
   4953 		}
   4954 
   4955 		/*
   4956 		 * Turn off our id
   4957 		 */
   4958 		tmp ^= myid;
   4959 
   4960 		if (tmp == 0) {
   4961 			/*
   4962 			 * There is no other SCSI id, therefore we cannot
   4963 			 * tell who is reselecting us. This 'cannot happen'.
   4964 			 */
   4965 			bad_reselect = "no other scsi id";
   4966 			goto bad;
   4967 		}
   4968 
   4969 		target = scsi_targetid[tmp];
   4970 		if (target == -1) {
   4971 			/*
   4972 			 * There is more than one reselection id on the bus.
   4973 			 * This 'cannot happen'.
   4974 			 */
   4975 			bad_reselect = ">2 reselection IDs on the bus";
   4976 			goto bad;
   4977 		}
   4978 
   4979 		/*
   4980 		 * Now pick up identify message byte, and acknowledge it.
   4981 		 */
   4982 		if ((esp->e_stat & ESP_PHASE_MASK) != ESP_PHASE_MSG_IN) {
   4983 			/*
   4984 			 * If we aren't in MESSAGE IN phase,
   4985 			 * things are really screwed up.
   4986 			 */
   4987 			bad_reselect = "not in msg-in phase";
   4988 			goto bad;
   4989 		}
   4990 
   4991 		tmp = esp->e_last_msgin = ep->esp_fifo_data;
   4992 
   4993 		/*
   4994 		 * XXX: Oh boy. We have problems. What happens
   4995 		 * XXX: if we have a parity error on the IDENTIFY
   4996 		 * XXX: message? We cannot know which lun is
   4997 		 * XXX: reconnecting, but we really need to know
   4998 		 * XXX: that in order to go through all the
   4999 		 * XXX: rigamarole of sending a MSG_PARITY_ERR
   5000 		 * XXX: message back to the target.
   5001 		 * XXX:
   5002 		 * XXX: In order to minimize a panic situation,
   5003 		 * XXX: we'll assume a lun of zero (i.e., synthesize
   5004 		 * XXX: the IDENTIFY message), and only panic
   5005 		 * XXX: if there is more than one active lun on
   5006 		 * XXX: this target.
   5007 		 */
   5008 		if (esp->e_stat & ESP_STAT_PERR) {
   5009 			tmp = MSG_IDENTIFY;
   5010 		}
   5011 
   5012 		/*
   5013 		 * Check sanity of message.
   5014 		 */
   5015 		if (!(IS_IDENTIFY_MSG(tmp)) || (tmp & INI_CAN_DISCON)) {
   5016 			bad_reselect = "bad message";
   5017 			goto bad;
   5018 		}
   5019 
   5020 		lun = tmp & (NLUNS_PER_TARGET-1);
   5021 
   5022 		LOG_STATE(esp, ACTS_RESEL, esp->e_stat, target, lun);
   5023 
   5024 		if ((esp->e_options & ESP_OPT_FAS) == 0) {
   5025 
   5026 			esp_flush_fifo(esp);
   5027 
   5028 			/*
   5029 			 * As per the ESP100 errata sheets, if a selection
   5030 			 * attempt is preempted by a reselection coming in,
   5031 			 * we'll get a spurious ILLEGAL COMMAND error
   5032 			 * interrupt from the ESP100.
   5033 			 * Instead of trying to figure out whether we were
   5034 			 * preempted or not, just gate off of whether
   5035 			 * we are an ESP100 or not.
   5036 			 */
   5037 			if (IS_53C90(esp)) {
   5038 				tmp = ep->esp_intr;
   5039 				if (tmp & ESP_INT_RESET) {
   5040 					TRACE_0(TR_FAC_SCSI,
   5041 					    TR_ESP_RECONNECT_F1_END,
   5042 					    "esp_reconnect_end (_F1)");
   5043 					return (ACTION_FINRST);
   5044 				}
   5045 			}
   5046 
   5047 			/*
   5048 			 * I believe that this needs to be done to
   5049 			 * unlatch the ESP.
   5050 			 */
   5051 			Esp_cmd(esp, CMD_NOP);
   5052 		}
   5053 
   5054 
   5055 		/*
   5056 		 * If this target is synchronous, here is the
   5057 		 * place to set it up during a reconnect.
   5058 		 * Must setup for sync xfers because once identify msg ack'ed,
   5059 		 * we can go into data in phase and begin transferring data.
   5060 		 */
   5061 		period =  esp->e_period[target] & SYNC_PERIOD_MASK;
   5062 		offset = esp->e_offset[target];
   5063 		conf3 = esp->e_espconf3[target];
   5064 		if ((esp->e_period_last != period) ||
   5065 		    (esp->e_offset_last != offset) ||
   5066 		    (esp->e_espconf3_last != conf3)) {
   5067 			esp->e_period_last = ep->esp_sync_period = period;
   5068 			esp->e_offset_last = ep->esp_sync_offset = offset;
   5069 			esp->e_espconf3_last = ep->esp_conf3 = conf3;
   5070 		}
   5071 
   5072 		esp->e_cur_slot = slot = (target * NLUNS_PER_TARGET) | lun;
   5073 
   5074 		/*
   5075 		 * If tag queuing in use, DMA in tag.
   5076 		 * Otherwise, we're ready to go.
   5077 		 * XXX make this non-polled, interrupt driven
   5078 		 */
   5079 		if (TAGGED(target) && esp->e_tcmds[slot]) {
   5080 			volatile uchar_t *c =
   5081 			    (uchar_t *)esp->e_cmdarea;
   5082 
   5083 			/*
   5084 			 * accept the identify msg
   5085 			 */
   5086 			Esp_cmd(esp, CMD_MSG_ACPT);
   5087 
   5088 			/*
   5089 			 * If we've been doing tagged queuing and this
   5090 			 * request doesn't  do it,
   5091 			 * maybe it was disabled for this one.	This is rather
   5092 			 * dangerous as it blows all pending tagged cmds away.
   5093 			 * But if target is confused, then we'll blow up
   5094 			 * shortly.
   5095 			 */
   5096 			*c++ = INVALID_MSG;
   5097 			*c   = INVALID_MSG;
   5098 
   5099 			ESP_DMA_WRITE(esp, 2,
   5100 			    esp->e_dmacookie.dmac_address);
   5101 
   5102 			/*
   5103 			 * For tagged queuing, we should still be in msgin
   5104 			 * phase.
   5105 			 * If not, then either we aren't running tagged
   5106 			 * queuing like we thought or the target died.
   5107 			 */
   5108 			if (INTPENDING(esp) == 0) {
   5109 				EPRINTF1("slow reconnect, slot=%x\n", slot);
   5110 				TRACE_0(TR_FAC_SCSI,
   5111 				    TR_ESP_RECONNECT_RETURN1_END,
   5112 				    "esp_reconnect_end (_RETURN1)");
   5113 				return (ACTION_RETURN);
   5114 			}
   5115 
   5116 			esp->e_stat = ep->esp_stat;
   5117 			esp->e_intr = ep->esp_intr;
   5118 			if (esp->e_intr & ESP_INT_RESET) {
   5119 				TRACE_0(TR_FAC_SCSI, TR_ESP_RECONNECT_F2_END,
   5120 				    "esp_reconnect_end (_F2)");
   5121 				return (ACTION_FINRST);
   5122 			}
   5123 			if ((esp->e_stat & ESP_PHASE_MASK) !=
   5124 			    ESP_PHASE_MSG_IN) {
   5125 				bad_reselect = "not in msgin phase";
   5126 				sp = NULL;
   5127 				goto NO_TAG_MSG;
   5128 			}
   5129 
   5130 			if (esp->e_intr & ESP_INT_DISCON) {
   5131 				bad_reselect = "unexpected bus free";
   5132 				goto bad;
   5133 			}
   5134 		} else {
   5135 			sp = esp->e_slots[slot];
   5136 			break;
   5137 		}
   5138 		/*FALLTHROUGH*/
   5139 
   5140 	case ACTS_RESEL:
   5141 		{
   5142 			volatile uchar_t *c =
   5143 			    (uchar_t *)esp->e_cmdarea;
   5144 			struct t_slots *tag_slots;
   5145 			int id, tag;
   5146 			uint_t i;
   5147 
   5148 			if ((esp->e_stat & ESP_PHASE_MASK) !=
   5149 			    ESP_PHASE_MSG_IN) {
   5150 				IPRINTF1("no tag for slot %x\n",
   5151 				    esp->e_cur_slot);
   5152 				if (esp->e_intr & ~(ESP_INT_BUS |
   5153 				    ESP_INT_FCMP)) {
   5154 					New_state(esp, ACTS_UNKNOWN);
   5155 					TRACE_0(TR_FAC_SCSI,
   5156 					    TR_ESP_RECONNECT_PHASEMANAGE_END,
   5157 					    "esp_reconnect_end (_PHASEMANAGE)");
   5158 					return (ACTION_PHASEMANAGE);
   5159 				} else {
   5160 					sp = NULL;
   5161 					bad_reselect = "not in msgin phase";
   5162 					break;
   5163 				}
   5164 			}
   5165 
   5166 			Esp_cmd(esp, CMD_DMA | CMD_TRAN_INFO);
   5167 			msg_accept_issued = 1;
   5168 			Esp_cmd(esp, CMD_MSG_ACPT);
   5169 
   5170 			for (i = 0; i < (uint_t)RECONNECT_TAG_RCV_TIMEOUT;
   5171 			    i++) {
   5172 				/*
   5173 				 * timeout is not very accurate but this
   5174 				 * should take no time at all
   5175 				 */
   5176 				if (INTPENDING(esp)) {
   5177 					esp->e_stat = esp->e_reg->esp_stat;
   5178 					esp->e_intr = esp->e_reg->esp_intr;
   5179 					if (esp->e_intr & ESP_INT_RESET) {
   5180 						TRACE_0(TR_FAC_SCSI,
   5181 						    TR_ESP_RECONNECT_F3_END,
   5182 						    "esp_reconnect_end (_F3)");
   5183 						return (ACTION_FINRST);
   5184 					}
   5185 					if (esp->e_intr & ESP_INT_FCMP) {
   5186 						break;
   5187 					}
   5188 				}
   5189 				drv_usecwait(1);
   5190 			}
   5191 
   5192 			if (i == (uint_t)RECONNECT_TAG_RCV_TIMEOUT) {
   5193 				bad_reselect = "timeout on tag byte";
   5194 				sp = NULL;
   5195 				goto NO_TAG_MSG;
   5196 			}
   5197 
   5198 			ESP_DRAIN_DMA(esp);
   5199 
   5200 			/*
   5201 			 * XXX we should really do a sync here but that
   5202 			 * hurts performance too much; we'll just hang
   5203 			 * around till the tag byte flips
   5204 			 * This is necessary on any system with an
   5205 			 * XBox
   5206 			 */
   5207 			if (*c == INVALID_MSG) {
   5208 				EPRINTF(
   5209 				    "esp_reconnect: invalid msg, polling\n");
   5210 				for (i = 0; i < 1000000; i++) {
   5211 					if (*c != INVALID_MSG)
   5212 						break;
   5213 				}
   5214 			}
   5215 
   5216 			if (esp->e_stat & ESP_STAT_PERR) {
   5217 				sp = NULL;
   5218 				bad_reselect = "parity error in tag msg";
   5219 				goto NO_TAG_MSG;
   5220 			}
   5221 
   5222 			slot = esp->e_cur_slot;
   5223 			target = slot/NLUNS_PER_TARGET;
   5224 
   5225 			if ((esp->e_stat & ESP_STAT_XZERO) == 0 ||
   5226 			    (id = *c++) < MSG_SIMPLE_QTAG ||
   5227 			    id > MSG_ORDERED_QTAG) {
   5228 				/*
   5229 				 * Target agreed to do tagged queuing
   5230 				 * and lied!
   5231 				 * This problem implies the drive firmware is
   5232 				 *  broken.
   5233 				 */
   5234 				lun = slot % NLUNS_PER_TARGET;
   5235 				esplog(esp, CE_WARN, botched_tag, target,
   5236 				    lun, id, *c);
   5237 				sp = NULL;
   5238 				bad_reselect = "botched tag";
   5239 				goto NO_TAG_MSG;
   5240 			}
   5241 			tag = *c;
   5242 
   5243 			LOG_STATE(esp, ACTS_TAG, id, tag, -1);
   5244 
   5245 			/* Set ptr to reconnecting scsi pkt */
   5246 			tag_slots = esp->e_tagQ[slot];
   5247 			if (tag_slots != NULL) {
   5248 				sp = tag_slots->t_slot[tag];
   5249 			} else {
   5250 				EPRINTF2("Invalid tag, que= 0x%x tag= %d\n",
   5251 				    id, tag);
   5252 				sp = NULL;
   5253 				bad_reselect = "invalid tag";
   5254 			}
   5255 
   5256 			esp->e_slots[slot] = sp;
   5257 		}
   5258 	}
   5259 
   5260 NO_TAG_MSG:
   5261 	if (esp->e_stat & ESP_STAT_PERR) {
   5262 		bad_reselect = "parity error";
   5263 		sp = 0;
   5264 	}
   5265 
   5266 	if ((sp == (struct esp_cmd *)0) ||
   5267 #ifdef ESP_TEST_ABORT
   5268 	    (esp_atest_reconn & (1<<Tgt(sp))) ||
   5269 #endif
   5270 	    (sp->cmd_flags & (CFLAG_CMDDISC|CFLAG_CMDPROXY)) == 0) {
   5271 		/*
   5272 		 * this shouldn't really happen, so it is better
   5273 		 * to reset the bus; some disks accept the abort
   5274 		 * and then still reconnect
   5275 		 */
   5276 #ifdef ESP_TEST_ABORT
   5277 		esp_atest_reconn = 0;
   5278 #endif
   5279 		if (bad_reselect == NULL) {
   5280 			bad_reselect = "no valid cmd";
   5281 		}
   5282 		goto bad;
   5283 
   5284 	} else if (sp->cmd_flags & CFLAG_CMDPROXY) {
   5285 		/*
   5286 		 * If we got here, we were already attempting to
   5287 		 * run a polled proxy command for this target.
   5288 		 * Set ATN and, copy in the message, and drive
   5289 		 * on (ignoring any parity error on the identify).
   5290 		 * XXX this may not be very useful....
   5291 		 */
   5292 		IPRINTF2("esp_reconnect: fielding proxy cmd for %d.%d\n",
   5293 		    target, lun);
   5294 		Esp_cmd(esp, CMD_SET_ATN);
   5295 		esp->e_omsglen = sp->cmd_cdb[ESP_PROXY_DATA];
   5296 		tmp = 0;
   5297 		while (tmp < esp->e_omsglen) {
   5298 			esp->e_cur_msgout[tmp] =
   5299 			    sp->cmd_cdb[ESP_PROXY_DATA+1+tmp];
   5300 			tmp++;
   5301 		}
   5302 		sp->cmd_cdb[ESP_PROXY_RESULT] = FALSE;
   5303 
   5304 		/*
   5305 		 * pretend that the disconnected cmd is still disconnected
   5306 		 * (this prevents ndisc from going negative)
   5307 		 */
   5308 		esp->e_ndisc++;
   5309 
   5310 	} else if (esp->e_target_scsi_options[target] & SCSI_OPTIONS_PARITY) {
   5311 		/*
   5312 		 * If we are doing PARITY checking, check for a parity
   5313 		 * error on the IDENTIFY message.
   5314 		 */
   5315 		if (sp->cmd_pkt.pkt_flags & FLAG_NOPARITY) {
   5316 			/*
   5317 			 * If we had detected a parity error
   5318 			 * on the IDENTIFY message, and this
   5319 			 * command is being run without checking,
   5320 			 * act as if we didn't get a parity
   5321 			 * error. The assumption here is that
   5322 			 * we only disable parity checking for
   5323 			 * targets that don't generate parity.
   5324 			 */
   5325 			ep->esp_conf = esp->e_espconf & ~ESP_CONF_PAREN;
   5326 		} else if (esp->e_stat & ESP_STAT_PERR) {
   5327 			esp->e_cur_msgout[0] = MSG_MSG_PARITY;
   5328 			esp->e_omsglen = 1;
   5329 		}
   5330 	}
   5331 	ASSERT(sp->cmd_flags & CFLAG_IN_TRANSPORT);
   5332 
   5333 	/*
   5334 	 * Accept the last message if we haven't done so
   5335 	 */
   5336 	if (msg_accept_issued == 0) {
   5337 		Esp_cmd(esp, CMD_MSG_ACPT);
   5338 	}
   5339 
   5340 	ASSERT(esp->e_cur_slot == slot);
   5341 	ASSERT(esp->e_ndisc > 0);
   5342 	esp->e_ndisc--;
   5343 	sp->cmd_flags &= ~CFLAG_CMDDISC;
   5344 	New_state(esp, ACTS_UNKNOWN);
   5345 
   5346 	/*
   5347 	 * A reconnect may imply a restore pointers operation
   5348 	 * Note that some older disks (Micropolis in Pbox) do not
   5349 	 * send a save data ptr on disconnect if all data has been
   5350 	 * xferred. So, we cannot restore ptrs yet here.
   5351 	 */
   5352 	if ((sp->cmd_flags & CFLAG_DMAVALID) &&
   5353 	    (sp->cmd_data_count != sp->cmd_saved_data_count)) {
   5354 		sp->cmd_flags |= CFLAG_RESTORE_PTRS;
   5355 	}
   5356 
   5357 	/*
   5358 	 * And zero out the SYNC negotiation counter
   5359 	 */
   5360 	esp->e_sdtr = 0;
   5361 
   5362 	/*
   5363 	 * Return to await the FUNCTION COMPLETE interrupt we
   5364 	 * should get out of accepting the IDENTIFY message.
   5365 	 */
   5366 	EPRINTF2("Reconnecting %d.%d\n", target, lun);
   5367 	TRACE_0(TR_FAC_SCSI, TR_ESP_RECONNECT_RETURN2_END,
   5368 	    "esp_reconnect_end (_RETURN2)");
   5369 	return (ACTION_RETURN);
   5370 
   5371 bad:
   5372 	esplog(esp, CE_WARN, "failed reselection (%s)", bad_reselect);
   5373 #ifdef ESPDEBUG
   5374 	esp_printstate(esp, "failed reselection");
   5375 #endif
   5376 	LOG_STATE(esp, ACTS_BAD_RESEL, esp->e_stat, -1, -1);
   5377 	TRACE_0(TR_FAC_SCSI, TR_ESP_RECONNECT_RESET5_END,
   5378 	    "esp_reconnect_end (_RESET5)");
   5379 	return (ACTION_RESET);
   5380 }
   5381 
   5382 static int
   5383 esp_handle_unknown(struct esp *esp)
   5384 {
   5385 	TRACE_1(TR_FAC_SCSI, TR_ESP_HANDLE_UNKNOWN_START,
   5386 	    "esp_handle_unknown_start: esp 0x%p", (void *)esp);
   5387 	EPRINTF("esp_handle_unknown:\n");
   5388 	LOG_STATE(esp, ACTS_UNKNOWN, esp->e_stat, -1, -1);
   5389 
   5390 	if ((esp->e_intr & ESP_INT_DISCON) == 0) {
   5391 		/*
   5392 		 * we call actions here rather than returning to phasemanage
   5393 		 * (this is the most frequently called action)
   5394 		 */
   5395 		switch (esp->e_stat & ESP_PHASE_MASK) {
   5396 		case ESP_PHASE_DATA_IN:
   5397 		case ESP_PHASE_DATA_OUT:
   5398 			New_state(esp, ACTS_DATA);
   5399 			TRACE_0(TR_FAC_SCSI,
   5400 			    TR_ESP_HANDLE_UNKNOWN_PHASE_DATA_END,
   5401 			    "esp_handle_unknown_end (phase_data)");
   5402 			return (esp_handle_data(esp));
   5403 
   5404 		case ESP_PHASE_MSG_OUT:
   5405 			New_state(esp, ACTS_MSG_OUT);
   5406 			TRACE_0(TR_FAC_SCSI,
   5407 			    TR_ESP_HANDLE_UNKNOWN_PHASE_MSG_OUT_END,
   5408 			    "esp_handle_unknown_end (phase_msg_out)");
   5409 			return (esp_handle_msg_out(esp));
   5410 
   5411 		case ESP_PHASE_MSG_IN:
   5412 			New_state(esp, ACTS_MSG_IN);
   5413 			TRACE_0(TR_FAC_SCSI,
   5414 			    TR_ESP_HANDLE_UNKNOWN_PHASE_MSG_IN_END,
   5415 			    "esp_handle_unknown_end (phase_msg_in)");
   5416 			return (esp_handle_msg_in(esp));
   5417 
   5418 		case ESP_PHASE_STATUS:
   5419 			esp_flush_fifo(esp);
   5420 #ifdef	ESP_TEST_PARITY
   5421 			if (esp_ptest_status & (1<<Tgt(CURRENT_CMD(esp)))) {
   5422 				Esp_cmd(esp, CMD_SET_ATN);
   5423 			}
   5424 #endif	/* ESP_TEST_PARITY */
   5425 			if (esp->e_options & ESP_OPT_STACKED_CMDS) {
   5426 				/*
   5427 				 * use a stacked cmd to complete
   5428 				 * and accept the msg
   5429 				 *
   5430 				 * stacked cmds sometimes fail with FAS101
   5431 				 * and some slow disks; they are only
   5432 				 * reliable on FAS236
   5433 				 */
   5434 				volatile uchar_t *c =
   5435 				    (uchar_t *)esp->e_cmdarea;
   5436 
   5437 				*c++ = INVALID_MSG;
   5438 				*c   = INVALID_MSG;
   5439 
   5440 				ESP_DMA_WRITE(esp, 2,
   5441 				    esp->e_dmacookie.dmac_address);
   5442 
   5443 				Esp_cmd(esp, CMD_COMP_SEQ | CMD_DMA);
   5444 				/*
   5445 				 * no back to back accesses to esp
   5446 				 */
   5447 				New_state(esp, ACTS_C_CMPLT);
   5448 				Esp_cmd(esp, CMD_MSG_ACPT);
   5449 			} else {
   5450 				Esp_cmd(esp, CMD_COMP_SEQ);
   5451 				New_state(esp, ACTS_C_CMPLT);
   5452 			}
   5453 			LOG_STATE(esp, ACTS_C_CMPLT, esp->e_stat, -1, -1);
   5454 			TRACE_0(TR_FAC_SCSI,
   5455 			    TR_ESP_HANDLE_UNKNOWN_PHASE_STATUS_END,
   5456 			    "esp_handle_unknown_end (phase_status)");
   5457 			return (esp_handle_c_cmplt(esp));
   5458 
   5459 		case ESP_PHASE_COMMAND:
   5460 			New_state(esp, ACTS_CMD_START);
   5461 			TRACE_0(TR_FAC_SCSI,
   5462 			    TR_ESP_HANDLE_UNKNOWN_PHASE_CMD_END,
   5463 			    "esp_handle_unknown_end (phase_cmd)");
   5464 			return (esp_handle_cmd_start(esp));
   5465 		}
   5466 
   5467 		esp_printstate(esp, "Unknown bus phase");
   5468 		TRACE_0(TR_FAC_SCSI, TR_ESP_HANDLE_UNKNOWN_RESET_END,
   5469 		    "esp_handle_unknown_end (reset)");
   5470 		return (ACTION_RESET);
   5471 
   5472 	} else {
   5473 		/*
   5474 		 * Okay. What to do now? Let's try (for the time being)
   5475 		 * assuming that the target went south and dropped busy,
   5476 		 * as a disconnect implies that either we received
   5477 		 * a completion or a disconnect message, or that we
   5478 		 * had sent an ABORT OPERATION or BUS DEVICE RESET
   5479 		 * message. In either case, we expected the disconnect
   5480 		 * and should have fielded it elsewhere.
   5481 		 *
   5482 		 * If we see a chip disconnect here, this is an unexpected
   5483 		 * loss of BSY*. Clean up the state of the chip and return.
   5484 		 *
   5485 		 */
   5486 		int msgout = esp->e_cur_msgout[0];
   5487 		struct esp_cmd *sp = CURRENT_CMD(esp);
   5488 		int target = Tgt(sp);
   5489 
   5490 		esp_chip_disconnect(esp, sp);
   5491 
   5492 		if (msgout == MSG_HEAD_QTAG || msgout == MSG_SIMPLE_QTAG) {
   5493 			msgout = esp->e_cur_msgout[2];
   5494 		}
   5495 		EPRINTF4("msgout: %x %x %x, last_msgout=%x\n",
   5496 		    esp->e_cur_msgout[0], esp->e_cur_msgout[1],
   5497 		    esp->e_cur_msgout[2], esp->e_last_msgout);
   5498 
   5499 		if (msgout == MSG_ABORT || msgout == MSG_ABORT_TAG ||
   5500 		    msgout == MSG_DEVICE_RESET) {
   5501 			IPRINTF2("Successful %s message to target %d\n",
   5502 			    scsi_mname(msgout), Tgt(sp));
   5503 
   5504 			if (sp->cmd_flags & CFLAG_CMDPROXY) {
   5505 				sp->cmd_cdb[ESP_PROXY_RESULT] = TRUE;
   5506 			}
   5507 			if (msgout == MSG_ABORT || msgout == MSG_ABORT_TAG) {
   5508 				esp->e_abort++;
   5509 				if ((sp->cmd_flags & CFLAG_CMDPROXY) == 0) {
   5510 					MARK_PKT(sp, CMD_ABORTED, STAT_ABORTED);
   5511 				}
   5512 			} else if (msgout == MSG_DEVICE_RESET) {
   5513 				esp->e_reset++;
   5514 				if ((sp->cmd_flags & CFLAG_CMDPROXY) == 0) {
   5515 					MARK_PKT(sp, CMD_RESET,
   5516 					    STAT_DEV_RESET);
   5517 				}
   5518 				esp->e_offset[target] = 0;
   5519 				esp->e_sync_known &= ~(1<<target);
   5520 			}
   5521 		} else {
   5522 			if (sp->cmd_pkt.pkt_reason == CMD_CMPLT)
   5523 				sp->cmd_pkt.pkt_reason = CMD_UNX_BUS_FREE;
   5524 			LOG_STATE(esp, ACTS_CMD_LOST,
   5525 			    esp->e_stat, esp->e_xfer, -1);
   5526 			esp_flush_fifo(esp);
   5527 #ifdef ESPDEBUG
   5528 			esp_printstate(esp, "unexpected bus free");
   5529 #endif
   5530 		}
   5531 		TRACE_0(TR_FAC_SCSI, TR_ESP_HANDLE_UNKNOWN_INT_DISCON_END,
   5532 		    "esp_handle_unknown_end (int_discon)");
   5533 		return (ACTION_FINISH);
   5534 	}
   5535 	_NOTE(NOT_REACHED)
   5536 	/* NOTREACHED */
   5537 }
   5538 
   5539 
   5540 static int
   5541 esp_handle_clearing(struct esp *esp)
   5542 {
   5543 	struct esp_cmd *sp = CURRENT_CMD(esp);
   5544 
   5545 	TRACE_0(TR_FAC_SCSI, TR_ESP_HANDLE_CLEARING_START,
   5546 	    "esp_handle_clearing_start");
   5547 	EPRINTF("esp_handle_clearing:\n");
   5548 
   5549 	if (esp->e_laststate == ACTS_C_CMPLT ||
   5550 	    esp->e_laststate == ACTS_MSG_IN_DONE) {
   5551 		if (INTPENDING(esp)) {
   5552 			volatile struct espreg *ep = esp->e_reg;
   5553 			if (esp->e_options & ESP_OPT_MASK_OFF_STAT) {
   5554 				esp->e_stat = ep->esp_stat & ~ESP_STAT_RES;
   5555 			} else {
   5556 				esp->e_stat = ep->esp_stat;
   5557 			}
   5558 			esp->e_intr = ep->esp_intr;
   5559 			if (esp->e_intr & ESP_INT_RESET) {
   5560 				TRACE_0(TR_FAC_SCSI,
   5561 				    TR_ESP_HANDLE_CLEARING_FINRST_END,
   5562 				    "esp_handle_clearing_end (ACTION_FINRST)");
   5563 				return (ACTION_FINRST);
   5564 			}
   5565 		} else {
   5566 			/*
   5567 			 * change e_laststate for the next time around
   5568 			 */
   5569 			esp->e_laststate = ACTS_CLEARING;
   5570 			TRACE_0(TR_FAC_SCSI, TR_ESP_HANDLE_CLEARING_RETURN1_END,
   5571 			    "esp_handle_clearing_end (ACTION_RETURN1)");
   5572 			return (ACTION_RETURN);
   5573 		}
   5574 	}
   5575 
   5576 	if (esp->e_intr == ESP_INT_DISCON) {
   5577 		/*
   5578 		 * At this point the ESP chip has disconnected. The bus should
   5579 		 * be either quiet or someone may be attempting a reselection
   5580 		 * of us (or somebody else). Call the routine that sets the
   5581 		 * chip back to a correct and known state.
   5582 		 * If the last message in was a disconnect, search
   5583 		 * for new work to do, else return to call esp_finish()
   5584 		 */
   5585 		if (esp->e_last_msgin == MSG_DISCONNECT) {
   5586 			sp->cmd_pkt.pkt_statistics |= STAT_DISCON;
   5587 			sp->cmd_flags |= CFLAG_CMDDISC;
   5588 			if ((sp->cmd_flags & CFLAG_CMDPROXY) == 0) {
   5589 				esp->e_ndisc++;
   5590 			}
   5591 			esp_chip_disconnect(esp, sp);
   5592 			New_state(esp, STATE_FREE);
   5593 			ASSERT(esp->e_cur_slot != UNDEFINED);
   5594 			EPRINTF2("disconnecting %d.%d\n", Tgt(sp), Lun(sp));
   5595 
   5596 			if (sp->cmd_pkt.pkt_flags & FLAG_TAGMASK) {
   5597 				esp->e_slots[esp->e_cur_slot] = NULL;
   5598 			}
   5599 
   5600 			esp->e_last_slot = esp->e_cur_slot;
   5601 			esp->e_cur_slot = UNDEFINED;
   5602 
   5603 			/*
   5604 			 * start a cmd here to save time
   5605 			 */
   5606 			if (esp_ustart(esp, esp->e_last_slot, NEW_CMD)) {
   5607 				TRACE_0(TR_FAC_SCSI,
   5608 				    TR_ESP_HANDLE_CLEARING_RETURN2_END,
   5609 				    "esp_handle_clearing_end (ACTION_RETURN2)");
   5610 				return (ACTION_RETURN);
   5611 			}
   5612 			esp->e_last_msgout = 0xff;
   5613 			esp->e_omsglen = 0;
   5614 			TRACE_0(TR_FAC_SCSI, TR_ESP_HANDLE_CLEARING_RETURN3_END,
   5615 			    "esp_handle_clearing_end (ACTION_RETURN3)");
   5616 			return (ACTION_RETURN);
   5617 		} else {
   5618 			esp_chip_disconnect(esp, sp);
   5619 			esp->e_last_msgout = 0xff;
   5620 			esp->e_omsglen = 0;
   5621 			TRACE_0(TR_FAC_SCSI, TR_ESP_HANDLE_CLEARING_END,
   5622 			    "esp_handle_clearing_end");
   5623 			return (esp_finish(esp));
   5624 		}
   5625 	} else {
   5626 		/*
   5627 		 * If the chip/target didn't disconnect from the
   5628 		 * bus, that is a gross fatal error.
   5629 		 */
   5630 		esplog(esp, CE_WARN,
   5631 		    "Target %d didn't disconnect after sending %s",
   5632 		    Tgt(sp), scsi_mname(esp->e_last_msgin));
   5633 		if (sp->cmd_pkt.pkt_reason ==  CMD_CMPLT)
   5634 			sp->cmd_pkt.pkt_reason = CMD_TRAN_ERR;
   5635 #ifdef ESPDEBUG
   5636 		IPRINTF4("msgout: %x %x %x, last_msgout=%x\n",
   5637 		    esp->e_cur_msgout[0], esp->e_cur_msgout[1],
   5638 		    esp->e_cur_msgout[2], esp->e_last_msgout);
   5639 		IPRINTF1("last msgin=%x\n", esp->e_last_msgin);
   5640 		esp_dump_state(esp);
   5641 #endif
   5642 		TRACE_0(TR_FAC_SCSI, TR_ESP_HANDLE_CLEARING_ABORT_END,
   5643 		    "esp_handle_clearing_end (ACTION_ABORT_CURCMD)");
   5644 		return (ACTION_ABORT_ALLCMDS);
   5645 	}
   5646 }
   5647 
   5648 
   5649 
   5650 static int
   5651 esp_handle_data(struct esp *esp)
   5652 {
   5653 	uint64_t end;
   5654 	uint32_t amt;
   5655 	struct esp_cmd *sp = CURRENT_CMD(esp);
   5656 	int sending;
   5657 
   5658 	TRACE_0(TR_FAC_SCSI, TR_ESP_HANDLE_DATA_START,
   5659 	    "esp_handle_data_start");
   5660 	EPRINTF2("esp_handle_data: sp=0x%p, flags=%x\n",
   5661 	    (void *)sp, sp->cmd_flags);
   5662 
   5663 	if (IS_53C90(esp)) {
   5664 		Esp_cmd(esp, CMD_NOP);	/* per ESP errata sheet */
   5665 	}
   5666 
   5667 	if ((sp->cmd_flags & CFLAG_DMAVALID) == 0) {
   5668 		esp_printstate(esp, "unexpected data phase");
   5669 		/*
   5670 		 * XXX: This isn't the right reason
   5671 		 */
   5672 bad:
   5673 		if (sp->cmd_pkt.pkt_reason == CMD_CMPLT)
   5674 			sp->cmd_pkt.pkt_reason = CMD_TRAN_ERR;
   5675 		TRACE_0(TR_FAC_SCSI, TR_ESP_HANDLE_DATA_ABORT1_END,
   5676 		    "esp_handle_data_end (ACTION_ABORT_CURCMD1)");
   5677 		return (ACTION_ABORT_CURCMD);
   5678 	} else {
   5679 		sending = (sp->cmd_flags & CFLAG_DMASEND)? 1 : 0;
   5680 	}
   5681 
   5682 	if (sp->cmd_flags & CFLAG_RESTORE_PTRS) {
   5683 		if (esp_restore_pointers(esp, sp)) {
   5684 			return (ACTION_ABORT_CURCMD);
   5685 		}
   5686 		sp->cmd_flags &= ~CFLAG_RESTORE_PTRS;
   5687 	}
   5688 
   5689 	/*
   5690 	 * make sure our DMA pointers are in good shape.
   5691 	 *
   5692 	 * Because SCSI is SCSI, the current DMA pointer has got to be
   5693 	 * greater than or equal to our DMA base address. All other cases
   5694 	 * that might have affected this always set curaddr to be >=
   5695 	 * to the DMA base address.
   5696 	 */
   5697 	ASSERT(sp->cmd_cur_addr >= sp->cmd_dmacookie.dmac_address);
   5698 	end = (uint64_t)sp->cmd_dmacookie.dmac_address +
   5699 	    (uint64_t)sp->cmd_dmacookie.dmac_size;
   5700 
   5701 	EPRINTF5("cmd_data_count=%x, dmacount=%x, cur_addr=%x, end=%"
   5702 	    PRIx64 ", nwin=%x\n",
   5703 	    sp->cmd_data_count, sp->cmd_dmacount, sp->cmd_cur_addr, end,
   5704 	    sp->cmd_nwin);
   5705 	EPRINTF2("dmac_address=%x, dmac_size=%lx\n",
   5706 	    sp->cmd_dmacookie.dmac_address, sp->cmd_dmacookie.dmac_size);
   5707 
   5708 	if ((sp->cmd_data_count >= sp->cmd_dmacount) ||
   5709 	    (sp->cmd_cur_addr >= end)) {
   5710 		if (esp_next_window(esp, sp)) {
   5711 			goto bad;
   5712 		}
   5713 		end = (uint64_t)sp->cmd_dmacookie.dmac_address +
   5714 		    (uint64_t)sp->cmd_dmacookie.dmac_size;
   5715 		IPRINTF2("dmac_address=%x, dmac_size=%lx\n",
   5716 		    sp->cmd_dmacookie.dmac_address,
   5717 		    sp->cmd_dmacookie.dmac_size);
   5718 	}
   5719 
   5720 	amt = end - sp->cmd_cur_addr;
   5721 	if (ESP_MAX_DMACOUNT < amt) {
   5722 		amt = ESP_MAX_DMACOUNT;
   5723 	}
   5724 	EPRINTF3("amt=%x, end=%lx, cur_addr=%x\n", amt, end, sp->cmd_cur_addr);
   5725 
   5726 #ifdef ESPDEBUG
   5727 	/*
   5728 	 * Make sure that we don't cross a boundary we can't handle
   5729 	 * This is probably checked as well by the DMA framework
   5730 	 */
   5731 	end = (uint64_t)sp->cmd_cur_addr + (uint64_t)amt - 1;
   5732 	if ((end & ~esp->e_dma_attr->dma_attr_seg) !=
   5733 	    (sp->cmd_cur_addr & ~esp->e_dma_attr->dma_attr_seg)) {
   5734 		IPRINTF3("cur_addr %x cur_addr+amt %" PRIx64
   5735 		    " cntr_max %" PRIx64 "\n",
   5736 		    sp->cmd_cur_addr, end, esp->e_dma_attr->dma_attr_seg);
   5737 		amt = (end & ~esp->e_dma_attr->dma_attr_seg) -
   5738 		    sp->cmd_cur_addr;
   5739 		if (amt == 0 || amt > ESP_MAX_DMACOUNT) {
   5740 			esplog(esp, CE_WARN, "illegal DMA boundary? %x", amt);
   5741 			goto bad;
   5742 		}
   5743 	}
   5744 #endif
   5745 	end = (uint64_t)sp->cmd_dmacookie.dmac_address +
   5746 	    (uint64_t)sp->cmd_dmacookie.dmac_size -
   5747 	    (uint64_t)sp->cmd_cur_addr;
   5748 	EPRINTF3("amt=%x, end=%lx, cur_addr=%x\n", amt, end, sp->cmd_cur_addr);
   5749 
   5750 	if (amt > end) {
   5751 		IPRINTF4("ovflow amt=%x end=%" PRIx64 " curaddr=%x count=%x\n",
   5752 		    amt, end, sp->cmd_cur_addr, sp->cmd_dmacount);
   5753 		amt = end;
   5754 	}
   5755 
   5756 	esp->e_lastcount = amt;
   5757 #ifdef	ESPDEBUG
   5758 	esp->e_xfer = amt;
   5759 #endif	/* ESPDEBUG */
   5760 
   5761 	EPRINTF4("%d.%d cmd 0x%x to xfer %x\n", Tgt(sp), Lun(sp),
   5762 	    sp->cmd_pkt.pkt_cdbp[0], amt);
   5763 
   5764 	if ((esp->e_stat & ESP_PHASE_MASK) == ESP_PHASE_DATA_OUT) {
   5765 		if (!sending) {
   5766 			esplog(esp, CE_WARN,
   5767 			    "unwanted data out for Target %d", Tgt(sp));
   5768 			if (sp->cmd_pkt.pkt_reason == CMD_CMPLT)
   5769 				sp->cmd_pkt.pkt_reason = CMD_DMA_DERR;
   5770 			TRACE_0(TR_FAC_SCSI, TR_ESP_HANDLE_DATA_ABORT2_END,
   5771 			    "esp_handle_data_end (ACTION_ABORT_CURCMD2)");
   5772 			return (ACTION_ABORT_CURCMD);
   5773 		}
   5774 		ESP_SET_ESC_READ_COUNT(esp, amt, sp->cmd_cur_addr);
   5775 		ESP_DMA_READ(esp, amt, sp->cmd_cur_addr);
   5776 
   5777 		LOG_STATE(esp, ACTS_DATAOUT, esp->e_stat, amt, -1);
   5778 	} else {
   5779 		if (sending) {
   5780 			esplog(esp, CE_WARN,
   5781 			    "unwanted data in for Target %d", Tgt(sp));
   5782 			if (sp->cmd_pkt.pkt_reason == CMD_CMPLT)
   5783 				sp->cmd_pkt.pkt_reason = CMD_DMA_DERR;
   5784 			TRACE_0(TR_FAC_SCSI, TR_ESP_HANDLE_DATA_ABORT3_END,
   5785 			    "esp_handle_data_end (ACTION_ABORT_CURCMD3)");
   5786 			return (ACTION_ABORT_CURCMD);
   5787 		}
   5788 		ESP_DMA_WRITE(esp, amt, sp->cmd_cur_addr);
   5789 		LOG_STATE(esp, ACTS_DATAIN, esp->e_stat, amt, -1);
   5790 	}
   5791 
   5792 
   5793 #ifdef	ESP_TEST_PARITY
   5794 	if (!sending && (esp_ptest_data_in & (1<<Tgt(sp)))) {
   5795 		Esp_cmd(esp, CMD_SET_ATN);
   5796 	}
   5797 #endif	/* ESP_TEST_PARITY */
   5798 
   5799 	/*
   5800 	 * XXX DON't change the order of these two statements, see 1162008
   5801 	 */
   5802 	New_state(esp, ACTS_DATA_DONE);
   5803 	Esp_cmd(esp, CMD_TRAN_INFO|CMD_DMA);
   5804 
   5805 	TRACE_0(TR_FAC_SCSI, TR_ESP_HANDLE_DATA_END,
   5806 	    "esp_handle_data_end (ACTION_RETURN)");
   5807 	return (ACTION_RETURN);
   5808 }
   5809 
   5810 static int
   5811 esp_handle_data_done(struct esp *esp)
   5812 {
   5813 	volatile struct espreg *ep = esp->e_reg;
   5814 	volatile struct dmaga *dmar = esp->e_dma;
   5815 	struct esp_cmd *sp = CURRENT_CMD(esp);
   5816 	uint32_t xfer_amt;
   5817 	char spurious_data, do_drain_fifo, was_sending;
   5818 	uchar_t stat, tgt, fifoamt;
   5819 
   5820 	TRACE_0(TR_FAC_SCSI, TR_ESP_HANDLE_DATA_DONE_START,
   5821 	    "esp_handle_data_done_start");
   5822 	EPRINTF("esp_handle_data_done:\n");
   5823 
   5824 	tgt = Tgt(sp);
   5825 	stat = esp->e_stat;
   5826 	was_sending = (sp->cmd_flags & CFLAG_DMASEND) ? 1 : 0;
   5827 	spurious_data = do_drain_fifo = 0;
   5828 
   5829 	/*
   5830 	 * Check for DMAGA errors (parity or memory fault)
   5831 	 */
   5832 	if ((esp->e_dmaga_csr = dmar->dmaga_csr) & DMAGA_ERRPEND) {
   5833 		/*
   5834 		 * It would be desirable to set the ATN* line and attempt to
   5835 		 * do the whole schmear of INITIATOR DETECTED ERROR here,
   5836 		 * but that is too hard to do at present.
   5837 		 */
   5838 		esplog(esp, CE_WARN, "Unrecoverable DMA error on dma %s",
   5839 		    (was_sending) ? "send" : "receive");
   5840 		if (sp->cmd_pkt.pkt_reason == CMD_CMPLT)
   5841 			sp->cmd_pkt.pkt_reason = CMD_TRAN_ERR;
   5842 		TRACE_0(TR_FAC_SCSI, TR_ESP_HANDLE_DATA_DONE_RESET_END,
   5843 		    "esp_handle_data_done_end (ACTION_RESET)");
   5844 		return (ACTION_RESET);
   5845 	}
   5846 
   5847 	/*
   5848 	 * Data Receive conditions:
   5849 	 *
   5850 	 * Check for parity errors. If we have a parity error upon
   5851 	 * receive, the ESP chip has asserted ATN* for us already.
   5852 	 *
   5853 	 * For Rev-1 and Rev-2 dma gate arrays,
   5854 	 * make sure the last bytes have flushed.
   5855 	 */
   5856 	if (!was_sending) {
   5857 #ifdef	ESP_TEST_PARITY
   5858 		if (esp_ptest_data_in & (1<<tgt)) {
   5859 			esp_ptest_data_in = 0;
   5860 			stat |= ESP_STAT_PERR;
   5861 		}
   5862 #endif	/* ESP_TEST_PARITY */
   5863 		if (stat & ESP_STAT_PERR) {
   5864 			esplog(esp, CE_WARN,
   5865 			    "SCSI bus DATA IN phase parity error");
   5866 			esp->e_cur_msgout[0] = MSG_INITIATOR_ERROR;
   5867 			esp->e_omsglen = 1;
   5868 			sp->cmd_pkt.pkt_statistics |= STAT_PERR;
   5869 			sp->cmd_pkt.pkt_reason = CMD_TRAN_ERR;
   5870 		}
   5871 		ESP_DRAIN_DMA(esp);
   5872 	} else {
   5873 		/*
   5874 		 * clear state of dma gate array
   5875 		 */
   5876 		ESP_FLUSH_DMA(esp);
   5877 	}
   5878 
   5879 	/*
   5880 	 * Check to make sure we're still connected to the target.
   5881 	 * If the target dropped the bus, that is a fatal error.
   5882 	 * We don't even attempt to count what we were transferring
   5883 	 * here. Let esp_handle_unknown clean up for us.
   5884 	 */
   5885 	if (esp->e_intr != ESP_INT_BUS) {
   5886 		New_state(esp, ACTS_UNKNOWN);
   5887 		TRACE_0(TR_FAC_SCSI, TR_ESP_HANDLE_DATA_DONE_PHASEMANAGE_END,
   5888 		    "esp_handle_data_done_end (ACTION_PHASEMANAGE)");
   5889 		return (ACTION_PHASEMANAGE);
   5890 	}
   5891 
   5892 	/*
   5893 	 * Figure out how far we got.
   5894 	 * Latch up fifo amount first.
   5895 	 */
   5896 
   5897 	fifoamt = FIFO_CNT(ep);
   5898 
   5899 	if (stat & ESP_STAT_XZERO) {
   5900 		xfer_amt = esp->e_lastcount;
   5901 	} else {
   5902 		GET_ESP_COUNT(ep, xfer_amt);
   5903 		xfer_amt = esp->e_lastcount - xfer_amt;
   5904 	}
   5905 
   5906 	/*
   5907 	 * Unconditionally knock off by the amount left
   5908 	 * in the fifo if we were sending out the SCSI bus.
   5909 	 *
   5910 	 * If we were receiving from the SCSI bus, believe
   5911 	 * what the chip told us (either XZERO or by the
   5912 	 * value calculated from the counter register).
   5913 	 * The reason we don't look at the fifo for
   5914 	 * incoming data is that in synchronous mode
   5915 	 * the fifo may have further data bytes, and
   5916 	 * for async mode we assume that all data in
   5917 	 * the fifo will have been transferred before
   5918 	 * the esp asserts an interrupt.
   5919 	 */
   5920 	if (was_sending) {
   5921 		xfer_amt -= fifoamt;
   5922 	}
   5923 
   5924 	/*
   5925 	 * If this was a synchronous transfer, flag it.
   5926 	 * Also check for the errata condition of long
   5927 	 * last REQ/ pulse for some synchronous targets
   5928 	 */
   5929 	if (esp->e_offset[tgt]) {
   5930 		/*
   5931 		 * flag that a synchronous data xfer took place
   5932 		 */
   5933 		sp->cmd_pkt.pkt_statistics |= STAT_SYNC;
   5934 
   5935 		if (IS_53C90(esp)) {
   5936 			static char *spur =
   5937 			    "Spurious %s phase from target %d\n";
   5938 			uchar_t phase;
   5939 
   5940 			/*
   5941 			 * Okay, latch up new status register value
   5942 			 */
   5943 
   5944 			/*
   5945 			 * Get a new stat from the esp chip register.
   5946 			 */
   5947 
   5948 			esp->e_stat = stat = phase = ep->esp_stat;
   5949 			phase &= ESP_PHASE_MASK;
   5950 
   5951 			/*
   5952 			 * Now, if we're still (maybe) in a data phase,
   5953 			 * check to be real sure that we are...
   5954 			 */
   5955 
   5956 			if (phase == ESP_PHASE_DATA_IN) {
   5957 				if (FIFO_CNT(ep) == 0)
   5958 					spurious_data = 1;
   5959 			} else if (phase == ESP_PHASE_DATA_OUT) {
   5960 				if ((ep->esp_fifo_flag & ESP_FIFO_ONZ) == 0)
   5961 					spurious_data = -1;
   5962 			}
   5963 
   5964 			if (spurious_data) {
   5965 				Esp_cmd(esp, CMD_MSG_ACPT);
   5966 				esplog(esp, CE_WARN,
   5967 				    spur, (spurious_data < 0) ?
   5968 				    "data out": "data in", tgt);
   5969 
   5970 				/*
   5971 				 * It turns out that this can also
   5972 				 * come about if the target resets
   5973 				 * (and goes back to async SCSI mode)
   5974 				 * and we don't know about it.
   5975 				 *
   5976 				 * The degenerate case for this is
   5977 				 * turning off a lunchbox- this clears
   5978 				 * it's state. The trouble is is that
   5979 				 * we'll get a check condition (likely)
   5980 				 * on the next command after a power-cycle
   5981 				 * for this target, but we'll have to
   5982 				 * go into a DATA IN phase to pick up
   5983 				 * the sense information for the Request
   5984 				 * Sense that will likely follow that
   5985 				 * Check Condition.
   5986 				 *
   5987 				 * As a temporary fix, I'll clear
   5988 				 * the 'sync_known' flag for this
   5989 				 * target so that the next selection
   5990 				 * for this target will renegotiate
   5991 				 * the sync protocol to be followed.
   5992 				 */
   5993 
   5994 				esp->e_sync_known &= ~(1<<tgt);
   5995 			}
   5996 			if (spurious_data == 0 && was_sending)
   5997 				do_drain_fifo = 1;
   5998 		} else {
   5999 			/*
   6000 			 * The need to handle for the ESP100A the case
   6001 			 * of turning off/on a target, thus destroying
   6002 			 * it's sync. setting is covered in esp_finish()
   6003 			 * where a CHECK CONDITION status causes the
   6004 			 * esp->e_sync_known flag to be cleared.
   6005 			 *
   6006 			 * If we are doing synchronous DATA OUT,
   6007 			 * we should probably drain the fifo.
   6008 			 * If we are doing synchronous DATA IN,
   6009 			 * we really don't dare do that (in case
   6010 			 * we are going from data phase to data
   6011 			 * phase).
   6012 			 */
   6013 
   6014 			if (was_sending)
   6015 				do_drain_fifo = 1;
   6016 		}
   6017 	} else {
   6018 		/*
   6019 		 * If we aren't doing Synchronous Data Transfers,
   6020 		 * definitely offload the fifo.
   6021 		 */
   6022 		do_drain_fifo = 1;
   6023 	}
   6024 
   6025 	/*
   6026 	 * Drain the fifo here of any left over
   6027 	 * that weren't transferred (if desirable).
   6028 	 */
   6029 	if (do_drain_fifo) {
   6030 		esp_flush_fifo(esp);
   6031 	}
   6032 
   6033 	/*
   6034 	 * adjust pointers...
   6035 	 */
   6036 	sp->cmd_data_count += xfer_amt;
   6037 	sp->cmd_cur_addr += xfer_amt;
   6038 
   6039 #ifdef	ESPDEBUG
   6040 	if (espdebug > 1 && esp->e_lastcount >= 0x200 && (xfer_amt & 0x1ff)) {
   6041 		eprintf(esp,
   6042 		    "DATA %s phase for %d.%d did 0x%x of 0x%x bytes\n",
   6043 		    (was_sending)? "OUT" : "IN", tgt, Lun(sp),
   6044 		    xfer_amt, esp->e_lastcount);
   6045 		esp_stat_int_print(esp);
   6046 	}
   6047 #endif	/* ESPDEBUG */
   6048 
   6049 	sp->cmd_pkt.pkt_state |= STATE_XFERRED_DATA;
   6050 	New_state(esp, ACTS_UNKNOWN);
   6051 	if (spurious_data == 0) {
   6052 		stat &= ESP_PHASE_MASK;
   6053 		if (stat == ESP_PHASE_DATA_IN || stat == ESP_PHASE_DATA_OUT) {
   6054 			esp->e_state = ACTS_DATA;
   6055 			TRACE_0(TR_FAC_SCSI,
   6056 			    TR_ESP_HANDLE_DATA_DONE_ACTION1_END,
   6057 			    "esp_handle_data_done_end (action1)");
   6058 			return (esp_handle_data(esp));
   6059 		} else {
   6060 			TRACE_0(TR_FAC_SCSI,
   6061 			    TR_ESP_HANDLE_DATA_DONE_ACTION2_END,
   6062 			    "esp_handle_data_done_end (action2)");
   6063 			return (esp_handle_unknown(esp));
   6064 		}
   6065 	} else {
   6066 		TRACE_0(TR_FAC_SCSI, TR_ESP_HANDLE_DATA_DONE_END,
   6067 		    "esp_handle_data_done_end (ACTION_RETURN)");
   6068 		return (ACTION_RETURN);
   6069 	}
   6070 }
   6071 
   6072 static char *msginperr = "SCSI bus MESSAGE IN phase parity error\n";
   6073 
   6074 static int
   6075 esp_handle_c_cmplt(struct esp *esp)
   6076 {
   6077 	struct esp_cmd *sp = CURRENT_CMD(esp);
   6078 	volatile struct espreg *ep = esp->e_reg;
   6079 	uchar_t sts, msg, msgout, intr, perr;
   6080 	volatile uchar_t *c = (uchar_t *)esp->e_cmdarea;
   6081 
   6082 	TRACE_0(TR_FAC_SCSI, TR_ESP_HANDLE_C_CMPLT_START,
   6083 	    "esp_handle_c_cmplt_start");
   6084 	EPRINTF("esp_handle_c_cmplt:\n");
   6085 
   6086 	/*
   6087 	 * if target is fast, we can get cmd. completion by the time we get
   6088 	 * here. Otherwise, we'll have to taken an interrupt.
   6089 	 */
   6090 	if (esp->e_laststate == ACTS_UNKNOWN) {
   6091 		if (INTPENDING(esp)) {
   6092 			if (esp->e_options & ESP_OPT_MASK_OFF_STAT) {
   6093 				esp->e_stat = ep->esp_stat & ~ESP_STAT_RES;
   6094 			} else {
   6095 				esp->e_stat = ep->esp_stat;
   6096 			}
   6097 			esp->e_intr = intr = ep->esp_intr;
   6098 			if (intr & ESP_INT_RESET) {
   6099 				TRACE_0(TR_FAC_SCSI,
   6100 				    TR_ESP_HANDLE_C_CMPLT_FINRST_END,
   6101 				    "esp_handle_c_cmplt_end (ACTION_FINRST)");
   6102 				return (ACTION_FINRST);
   6103 			}
   6104 		} else {
   6105 			/*
   6106 			 * change e_laststate for the next time around
   6107 			 */
   6108 			esp->e_laststate = ACTS_C_CMPLT;
   6109 			TRACE_0(TR_FAC_SCSI, TR_ESP_HANDLE_C_CMPLT_RETURN1_END,
   6110 			    "esp_handle_c_cmplt_end (ACTION_RETURN1)");
   6111 			return (ACTION_RETURN);
   6112 		}
   6113 	} else {
   6114 		intr = esp->e_intr;
   6115 	}
   6116 
   6117 #ifdef	ESP_TEST_PARITY
   6118 	if (esp_ptest_status & (1<<Tgt(sp))) {
   6119 		esp_ptest_status = 0;
   6120 		esp->e_stat |= ESP_STAT_PERR;
   6121 	} else if ((esp_ptest_msgin & (1<<Tgt(sp))) && esp_ptest_msg == 0) {
   6122 		Esp_cmd(esp, CMD_SET_ATN);
   6123 		esp_ptest_msgin = 0;
   6124 		esp_ptest_msg = -1;
   6125 		esp->e_stat |= ESP_STAT_PERR;
   6126 	}
   6127 #endif	/* ESP_TEST_PARITY */
   6128 
   6129 	if (intr == ESP_INT_DISCON) {
   6130 		New_state(esp, ACTS_UNKNOWN);
   6131 		TRACE_0(TR_FAC_SCSI, TR_ESP_HANDLE_C_CMPLT_ACTION1_END,
   6132 		    "esp_handle_c_cmplt_end (action1)");
   6133 		return (esp_handle_unknown(esp));
   6134 	}
   6135 
   6136 	if ((perr = (esp->e_stat & ESP_STAT_PERR)) != 0) {
   6137 		sp->cmd_pkt.pkt_statistics |= STAT_PERR;
   6138 	}
   6139 
   6140 	if (esp->e_options & ESP_OPT_STACKED_CMDS) {
   6141 		ESP_DRAIN_DMA(esp);
   6142 		/*
   6143 		 * we really need a ddi_dma_sync() here but that is too
   6144 		 * expensive; this loop is necessary for xbox, see
   6145 		 * also in esp_reconnect()
   6146 		 */
   6147 		if (*c == INVALID_MSG) {
   6148 			int i;
   6149 			EPRINTF("esp_handle_c_cmplt: invalid msg\n");
   6150 			for (i = 0; i < 1000000; i++) {
   6151 				if (*c != INVALID_MSG) {
   6152 					break;
   6153 				}
   6154 			}
   6155 		}
   6156 	} else {
   6157 		/*
   6158 		 * if we haven't done a stacked cmd with a MSG_ACPT,
   6159 		 * do a msg accept now and read the fifo data
   6160 		 */
   6161 		if (intr & ESP_INT_FCMP) {
   6162 			Esp_cmd(esp, CMD_MSG_ACPT);
   6163 			*c = ep->esp_fifo_data;
   6164 			*(c+1) = ep->esp_fifo_data;
   6165 		}
   6166 	}
   6167 
   6168 	msgout = 0;
   6169 	msg = sts = INVALID_MSG;
   6170 
   6171 	/*
   6172 	 * The ESP manuals state that this sequence completes
   6173 	 * with a BUS SERVICE interrupt if just the status
   6174 	 * byte was received, else a FUNCTION COMPLETE interrupt
   6175 	 * if both status and a message was received.
   6176 	 *
   6177 	 * The manuals also state that ATN* is asserted if
   6178 	 * bad parity is detected.
   6179 	 *
   6180 	 * The one case that we cannot handle is where we detect
   6181 	 * bad parity for the status byte, but the target refuses
   6182 	 * to go to MESSAGE OUT phase right away. This means that
   6183 	 * if that happens, we will misconstrue the parity error
   6184 	 * to be for the completion message, not the status byte.
   6185 	 */
   6186 	if (intr & ESP_INT_FCMP) {
   6187 		sts = *c++;
   6188 		esp->e_last_msgin = esp->e_imsgarea[0] = msg = *c;
   6189 		if (perr) {
   6190 			esplog(esp, CE_WARN, msginperr);
   6191 			msgout = MSG_MSG_PARITY;
   6192 		}
   6193 	} else if (intr == ESP_INT_BUS) {
   6194 		/*
   6195 		 * We only got the status byte.
   6196 		 */
   6197 		sts = *c;
   6198 
   6199 		IPRINTF1("esp_handle_cmd_cmplt: sts=%x, no msg byte\n", sts);
   6200 
   6201 		if (perr) {
   6202 			/*
   6203 			 * If we get a parity error on a status byte
   6204 			 * assume that it was a CHECK CONDITION
   6205 			 */
   6206 			sts = STATUS_CHECK;
   6207 			esplog(esp, CE_WARN,
   6208 			    "SCSI bus STATUS phase parity error");
   6209 			msgout = MSG_INITIATOR_ERROR;
   6210 		}
   6211 	} else {
   6212 		IPRINTF("esp_handle_cmd_cmplt: unexpected int\n");
   6213 		New_state(esp, ACTS_UNKNOWN);
   6214 		TRACE_0(TR_FAC_SCSI, TR_ESP_HANDLE_C_CMPLT_ACTION2_END,
   6215 		    "esp_handle_c_cmplt_end (action2)");
   6216 		return (esp_handle_unknown(esp));
   6217 	}
   6218 
   6219 	EPRINTF2("esp_handle_c_cmplt: status=%x, msg=%x\n", sts, msg);
   6220 
   6221 	if (sts != INVALID_MSG) {
   6222 		sp->cmd_pkt.pkt_state |= STATE_GOT_STATUS;
   6223 		*(sp->cmd_scbp) = sts;
   6224 		EPRINTF1("Status=0x%x\n", sts);
   6225 	}
   6226 	LOG_STATE(esp, ACTS_STATUS, esp->e_stat, sts, msg);
   6227 
   6228 	if (msgout == 0) {
   6229 		EPRINTF1("Completion Message=%s\n", scsi_mname(msg));
   6230 		if (msg == MSG_COMMAND_COMPLETE) {
   6231 			/*
   6232 			 * Actually, if the message was a 'linked command
   6233 			 * complete' message, the target isn't going to be
   6234 			 * clearing the bus.
   6235 			 */
   6236 			New_state(esp, ACTS_CLEARING);
   6237 		} else {
   6238 			esp->e_imsglen = 1;
   6239 			esp->e_imsgindex = 1;
   6240 			New_state(esp, ACTS_MSG_IN_DONE);
   6241 			TRACE_0(TR_FAC_SCSI, TR_ESP_HANDLE_C_CMPLT_ACTION3_END,
   6242 			    "esp_handle_c_cmplt_end (action3)");
   6243 			return (esp_handle_msg_in_done(esp));
   6244 		}
   6245 	} else {
   6246 		esp->e_cur_msgout[0] = msgout;
   6247 		esp->e_omsglen = 1;
   6248 		New_state(esp, ACTS_UNKNOWN);
   6249 	}
   6250 	LOG_STATE(esp, ACTS_C_CMPLT, esp->e_stat, esp->e_xfer, -1);
   6251 
   6252 	if (intr != ESP_INT_BUS) {
   6253 		if (esp->e_state == ACTS_CLEARING) {
   6254 			TRACE_0(TR_FAC_SCSI, TR_ESP_HANDLE_C_CMPLT_ACTION4_END,
   6255 			    "esp_handle_c_cmplt_end (action4)");
   6256 			return (esp_handle_clearing(esp));
   6257 		}
   6258 		TRACE_0(TR_FAC_SCSI, TR_ESP_HANDLE_C_CMPLT_RETURN2_END,
   6259 		    "esp_handle_c_cmplt_end (ACTION_RETURN2)");
   6260 		return (ACTION_RETURN);
   6261 	} else {
   6262 		if (esp->e_state == ACTS_UNKNOWN) {
   6263 			TRACE_0(TR_FAC_SCSI, TR_ESP_HANDLE_C_CMPLT_ACTION5_END,
   6264 			    "esp_handle_c_cmplt_end (action5)");
   6265 			return (esp_handle_unknown(esp));
   6266 		}
   6267 		TRACE_0(TR_FAC_SCSI, TR_ESP_HANDLE_C_CMPLT_PHASEMANAGE_END,
   6268 		    "esp_handle_c_cmplt_end (ACTION_PHASEMANAGE)");
   6269 		return (ACTION_PHASEMANAGE);
   6270 	}
   6271 }
   6272 
   6273 static int
   6274 esp_handle_msg_in(struct esp *esp)
   6275 {
   6276 	TRACE_0(TR_FAC_SCSI, TR_ESP_HANDLE_MSG_IN_START,
   6277 	    "esp_handle_msg_in_start");
   6278 	EPRINTF("esp_handle_msg_in\n");
   6279 
   6280 	/*
   6281 	 * Pick up a message byte.
   6282 	 * Clear the FIFO so we
   6283 	 * don't get confused.
   6284 	 */
   6285 	esp_flush_fifo(esp);
   6286 	if (IS_53C90(esp)) {
   6287 		Esp_cmd(esp, CMD_NOP);
   6288 	}
   6289 	Esp_cmd(esp, CMD_TRAN_INFO);
   6290 	esp->e_imsglen = 1;
   6291 	esp->e_imsgindex = 0;
   6292 	New_state(esp, ACTS_MSG_IN_DONE);
   6293 
   6294 	/*
   6295 	 * give a little extra time by returning to phasemanage
   6296 	 */
   6297 	TRACE_0(TR_FAC_SCSI, TR_ESP_HANDLE_MSG_IN_END,
   6298 	    "esp_handle_msg_in_end (ACTION_PHASEMANAGE)");
   6299 	return (ACTION_PHASEMANAGE);
   6300 }
   6301 
   6302 /*
   6303  * We come here after issuing a MSG_ACCEPT
   6304  * command and are expecting more message bytes.
   6305  * The ESP should be asserting a BUS SERVICE
   6306  * interrupt status, but may have asserted
   6307  * a different interrupt in the case that
   6308  * the target disconnected and dropped BSY*.
   6309  *
   6310  * In the case that we are eating up message
   6311  * bytes (and throwing them away unread) because
   6312  * we have ATN* asserted (we are trying to send
   6313  * a message), we do not consider it an error
   6314  * if the phase has changed out of MESSAGE IN.
   6315  */
   6316 static int
   6317 esp_handle_more_msgin(struct esp *esp)
   6318 {
   6319 	TRACE_0(TR_FAC_SCSI, TR_ESP_HANDLE_MORE_MSGIN_START,
   6320 	    "esp_handle_more_msgin_start");
   6321 	EPRINTF("esp_handle_more_msgin\n");
   6322 
   6323 	if (esp->e_intr & ESP_INT_BUS) {
   6324 		if ((esp->e_stat & ESP_PHASE_MASK) == ESP_PHASE_MSG_IN) {
   6325 			/*
   6326 			 * Fetch another byte of a message in.
   6327 			 */
   6328 			Esp_cmd(esp, CMD_TRAN_INFO);
   6329 			New_state(esp, ACTS_MSG_IN_DONE);
   6330 			TRACE_0(TR_FAC_SCSI,
   6331 			    TR_ESP_HANDLE_MORE_MSGIN_RETURN1_END,
   6332 			    "esp_handle_more_msgin_end (ACTION_RETURN)");
   6333 			return (ACTION_RETURN);
   6334 		}
   6335 
   6336 		/*
   6337 		 * If we were gobbling up a message and we have
   6338 		 * changed phases, handle this silently, else
   6339 		 * complain. In either case, we return to let
   6340 		 * esp_phasemanage() handle things.
   6341 		 *
   6342 		 * If it wasn't a BUS SERVICE interrupt,
   6343 		 * let esp_phasemanage() find out if the
   6344 		 * chip disconnected.
   6345 		 */
   6346 		if (esp->e_imsglen != 0) {
   6347 			esplog(esp, CE_WARN,
   6348 			    "Premature end of extended message");
   6349 		}
   6350 	}
   6351 	New_state(esp, ACTS_UNKNOWN);
   6352 	TRACE_0(TR_FAC_SCSI, TR_ESP_HANDLE_MORE_MSGIN_RETURN2_END,
   6353 	    "esp_handle_more_msgin_end (action)");
   6354 	return (esp_handle_unknown(esp));
   6355 }
   6356 
   6357 
   6358 static int
   6359 esp_handle_msg_in_done(struct esp *esp)
   6360 {
   6361 	struct esp_cmd *sp = CURRENT_CMD(esp);
   6362 	volatile struct espreg *ep = esp->e_reg;
   6363 	int sndmsg = 0;
   6364 	uchar_t msgin;
   6365 
   6366 	TRACE_0(TR_FAC_SCSI, TR_ESP_HANDLE_MSG_IN_DONE_START,
   6367 	    "esp_handle_msg_in_done_start");
   6368 	EPRINTF("esp_handle_msg_in_done:\n");
   6369 	if (esp->e_laststate == ACTS_MSG_IN) {
   6370 		if (INTPENDING(esp)) {
   6371 			if (esp->e_options & ESP_OPT_MASK_OFF_STAT) {
   6372 				esp->e_stat = ep->esp_stat & ~ESP_STAT_RES;
   6373 			} else {
   6374 				esp->e_stat = ep->esp_stat;
   6375 			}
   6376 			esp->e_intr = ep->esp_intr;
   6377 			if (esp->e_intr & ESP_INT_RESET) {
   6378 				TRACE_0(TR_FAC_SCSI,
   6379 				    TR_ESP_HANDLE_MSG_IN_DONE_FINRST_END,
   6380 				    "esp_handle_msg_in_done_end (_FINRST)");
   6381 				return (ACTION_FINRST);
   6382 			}
   6383 		} else {
   6384 			/*
   6385 			 * change e_laststate for the next time around
   6386 			 */
   6387 			esp->e_laststate = ACTS_MSG_IN_DONE;
   6388 			TRACE_0(TR_FAC_SCSI,
   6389 			    TR_ESP_HANDLE_MSG_IN_DONE_RETURN1_END,
   6390 			    "esp_handle_msg_in_done_end (ACTION_RETURN1)");
   6391 			return (ACTION_RETURN);
   6392 		}
   6393 	}
   6394 
   6395 	/*
   6396 	 * We can be called here for both the case where
   6397 	 * we had requested the ESP chip to fetch a message
   6398 	 * byte from the target (at the target's request).
   6399 	 * We can also be called in the case where we had
   6400 	 * been using the CMD_COMP_SEQ command to pick up
   6401 	 * both a status byte and a completion message from
   6402 	 * a target, but where the message wasn't one of
   6403 	 * COMMAND COMPLETE, LINKED COMMAND COMPLETE, or
   6404 	 * LINKED COMMAND COMPLETE (with flag). This is a
   6405 	 * legal (albeit extremely unusual) SCSI bus trans-
   6406 	 * -ition, so we have to handle it.
   6407 	 */
   6408 	if (esp->e_laststate != ACTS_C_CMPLT) {
   6409 #ifdef	ESP_TEST_PARITY
   6410 reloop:
   6411 #endif	/* ESP_TEST_PARITY */
   6412 
   6413 		if (esp->e_intr & ESP_INT_DISCON) {
   6414 			esplog(esp, CE_WARN,
   6415 			    "premature end of input message");
   6416 			New_state(esp, ACTS_UNKNOWN);
   6417 			TRACE_0(TR_FAC_SCSI,
   6418 			    TR_ESP_HANDLE_MSG_IN_DONE_PHASEMANAGE_END,
   6419 			    "esp_handle_msg_in_done_end (ACTION_PHASEMANAGE)");
   6420 			return (ACTION_PHASEMANAGE);
   6421 		}
   6422 
   6423 		/*
   6424 		 * Note that if e_imsglen is zero, then we are skipping
   6425 		 * input message bytes, so there is no reason to look for
   6426 		 * parity errors.
   6427 		 */
   6428 		if (esp->e_imsglen != 0 && (esp->e_stat & ESP_STAT_PERR)) {
   6429 
   6430 			esplog(esp, CE_WARN, msginperr);
   6431 			sndmsg = MSG_MSG_PARITY;
   6432 			sp->cmd_pkt.pkt_statistics |= STAT_PERR;
   6433 			esp_flush_fifo(esp);
   6434 
   6435 		} else if ((msgin = (FIFO_CNT(ep))) != 1) {
   6436 
   6437 			/*
   6438 			 * If we have got more than one byte in the fifo,
   6439 			 * that is a gross screwup, and we should let the
   6440 			 * target know that we have completely fouled up.
   6441 			 */
   6442 			eprintf(esp, "fifocount=%x\n", msgin);
   6443 			esp_printstate(esp, "input message botch");
   6444 			sndmsg = MSG_INITIATOR_ERROR;
   6445 			esp_flush_fifo(esp);
   6446 			esplog(esp, CE_WARN, "input message botch");
   6447 
   6448 		} else if (esp->e_imsglen == 0) {
   6449 
   6450 
   6451 			/*
   6452 			 * If we are in the middle of gobbling up and throwing
   6453 			 * away a message (due to a previous message input
   6454 			 * error), drive on.
   6455 			 */
   6456 			msgin = ep->esp_fifo_data;
   6457 			New_state(esp, ACTS_MSG_IN_MORE);
   6458 
   6459 		} else {
   6460 			esp->e_imsgarea[esp->e_imsgindex++] =
   6461 			    msgin = ep->esp_fifo_data;
   6462 		}
   6463 
   6464 	} else {
   6465 		/*
   6466 		 * In this case, we have been called (from
   6467 		 * esp_handle_c_cmplt()) with the message
   6468 		 * already stored in the message array.
   6469 		 */
   6470 		msgin = esp->e_imsgarea[0];
   6471 	}
   6472 
   6473 	/*
   6474 	 * Process this message byte (but not if we are
   6475 	 * going to be trying to send back some error
   6476 	 * anyway)
   6477 	 */
   6478 	if (sndmsg == 0 && esp->e_imsglen != 0) {
   6479 
   6480 		if (esp->e_imsgindex < esp->e_imsglen) {
   6481 
   6482 			EPRINTF2("message byte %d: 0x%x\n",
   6483 			    esp->e_imsgindex-1,
   6484 			    esp->e_imsgarea[esp->e_imsgindex-1]);
   6485 
   6486 			New_state(esp, ACTS_MSG_IN_MORE);
   6487 
   6488 		} else if (esp->e_imsglen == 1) {
   6489 
   6490 #ifdef	ESP_TEST_PARITY
   6491 			if ((esp_ptest_msgin & (1<<Tgt(sp))) &&
   6492 			    esp_ptest_msg == msgin) {
   6493 				esp_ptest_msgin = 0;
   6494 				esp_ptest_msg = -1;
   6495 				Esp_cmd(esp, CMD_SET_ATN);
   6496 				esp->e_stat |= ESP_STAT_PERR;
   6497 				esp->e_imsgindex -= 1;
   6498 				goto reloop;
   6499 			}
   6500 #endif	/* ESP_TEST_PARITY */
   6501 
   6502 			sndmsg = esp_onebyte_msg(esp);
   6503 
   6504 		} else if (esp->e_imsglen == 2) {
   6505 #ifdef	ESP_TEST_PARITY
   6506 			if (esp_ptest_emsgin & (1<<Tgt(sp))) {
   6507 				esp_ptest_emsgin = 0;
   6508 				Esp_cmd(esp, CMD_SET_ATN);
   6509 				esp->e_stat |= ESP_STAT_PERR;
   6510 				esp->e_imsgindex -= 1;
   6511 				goto reloop;
   6512 			}
   6513 #endif	/* ESP_TEST_PARITY */
   6514 
   6515 			if (esp->e_imsgarea[0] ==  MSG_EXTENDED) {
   6516 				static char *tool =
   6517 				    "Extended message 0x%x is too long";
   6518 
   6519 				/*
   6520 				 * Is the incoming message too long
   6521 				 * to be stored in our local array?
   6522 				 */
   6523 				if ((int)(msgin+2) > IMSGSIZE) {
   6524 					esplog(esp, CE_WARN,
   6525 					    tool, esp->e_imsgarea[0]);
   6526 					sndmsg = MSG_REJECT;
   6527 				} else {
   6528 					esp->e_imsglen = msgin + 2;
   6529 					New_state(esp, ACTS_MSG_IN_MORE);
   6530 				}
   6531 			} else {
   6532 				sndmsg = esp_twobyte_msg(esp);
   6533 			}
   6534 
   6535 		} else {
   6536 			sndmsg = esp_multibyte_msg(esp);
   6537 		}
   6538 	}
   6539 
   6540 	if (sndmsg < 0) {
   6541 		/*
   6542 		 * If sndmsg is less than zero, one of the subsidiary
   6543 		 * routines needs to return some other state than
   6544 		 * ACTION_RETURN.
   6545 		 */
   6546 		TRACE_0(TR_FAC_SCSI, TR_ESP_HANDLE_MSG_IN_DONE_SNDMSG_END,
   6547 		    "esp_handle_msg_in_done_end (-sndmsg)");
   6548 		return (-sndmsg);
   6549 	} else if (sndmsg > 0) {
   6550 		if (IS_1BYTE_MSG(sndmsg)) {
   6551 			esp->e_omsglen = 1;
   6552 		}
   6553 		esp->e_cur_msgout[0] = (uchar_t)sndmsg;
   6554 
   6555 		/*
   6556 		 * The target is not guaranteed to go to message out
   6557 		 * phase, period. Moreover, until the entire incoming
   6558 		 * message is transferred, the target may (and likely
   6559 		 * will) continue to transfer message bytes (which
   6560 		 * we will have to ignore).
   6561 		 *
   6562 		 * In order to do this, we'll go to 'infinite'
   6563 		 * message in handling by setting the current input
   6564 		 * message length to a sentinel of zero.
   6565 		 *
   6566 		 * This works regardless of the message we are trying
   6567 		 * to send out. At the point in time which we want
   6568 		 * to send a message in response to an incoming message
   6569 		 * we do not care any more about the incoming message.
   6570 		 *
   6571 		 * If we are sending a message in response to detecting
   6572 		 * a parity error on input, the ESP chip has already
   6573 		 * set ATN* for us, but it doesn't hurt to set it here
   6574 		 * again anyhow.
   6575 		 */
   6576 		Esp_cmd(esp, CMD_SET_ATN);
   6577 		New_state(esp, ACTS_MSG_IN_MORE);
   6578 		esp->e_imsglen = 0;
   6579 	}
   6580 
   6581 	/*
   6582 	 * do not give a MSG_ACPT if we are not in msg phase anymore
   6583 	 * and the target already dropped off the bus
   6584 	 * this is not worth the extra PIO read on viking based machines
   6585 	 * with FAS chips
   6586 	 */
   6587 	if ((esp->e_options & ESP_OPT_FAS) == 0) {
   6588 		esp->e_stat = esp->e_reg->esp_stat;
   6589 		if ((esp->e_stat & (ESP_STAT_MSG | ESP_STAT_CD)) ==
   6590 		    (ESP_STAT_MSG | ESP_STAT_CD)) {
   6591 			Esp_cmd(esp, CMD_MSG_ACPT);
   6592 		}
   6593 	} else {
   6594 		Esp_cmd(esp, CMD_MSG_ACPT);
   6595 	}
   6596 
   6597 	if ((esp->e_laststate == ACTS_MSG_IN_DONE) &&
   6598 	    (esp->e_state == ACTS_CLEARING)) {
   6599 		TRACE_0(TR_FAC_SCSI, TR_ESP_HANDLE_MSG_IN_DONE_ACTION_END,
   6600 		    "esp_handle_msg_in_done_end (action)");
   6601 		return (esp_handle_clearing(esp));
   6602 	}
   6603 	TRACE_0(TR_FAC_SCSI, TR_ESP_HANDLE_MSG_IN_DONE_RETURN2_END,
   6604 	    "esp_handle_msg_in_done_end (ACTION_RETURN2)");
   6605 	return (ACTION_RETURN);
   6606 }
   6607 
   6608 static int
   6609 esp_onebyte_msg(struct esp *esp)
   6610 {
   6611 	struct esp_cmd *sp = CURRENT_CMD(esp);
   6612 	int msgout = 0;
   6613 	uchar_t msgin = esp->e_last_msgin = esp->e_imsgarea[0];
   6614 	int tgt = Tgt(sp);
   6615 
   6616 	EPRINTF("esp_onebyte_msg\n");
   6617 
   6618 	if (msgin & MSG_IDENTIFY) {
   6619 		/*
   6620 		 * How did we get here? We should only see identify
   6621 		 * messages on a reconnection, but we'll handle this
   6622 		 * fine here (just in case we get this) as long as
   6623 		 * we believe that this is a valid identify message.
   6624 		 *
   6625 		 * For this to be a valid incoming message,
   6626 		 * bits 6-4 must must be zero. Also, the
   6627 		 * bit that says that I'm an initiator and
   6628 		 * can support disconnection cannot possibly
   6629 		 * be set here.
   6630 		 */
   6631 
   6632 		char garbled = ((msgin & (BAD_IDENTIFY|INI_CAN_DISCON)) != 0);
   6633 
   6634 		esplog(esp, CE_WARN, "%s message 0x%x from Target %d",
   6635 		    garbled ? "Garbled" : "Identify", msgin, tgt);
   6636 
   6637 		if (garbled) {
   6638 			/*
   6639 			 * If it's a garbled message,
   6640 			 * try and tell the target...
   6641 			 */
   6642 			msgout = MSG_INITIATOR_ERROR;
   6643 		} else {
   6644 			New_state(esp, ACTS_UNKNOWN);
   6645 		}
   6646 		LOG_STATE(esp, ACTS_MSG_IN, esp->e_stat, msgin, -1);
   6647 		return (msgout);
   6648 
   6649 	} else if (IS_2BYTE_MSG(msgin) || IS_EXTENDED_MSG(msgin)) {
   6650 		esp->e_imsglen = 2;
   6651 		New_state(esp, ACTS_MSG_IN_MORE);
   6652 		return (0);
   6653 	}
   6654 
   6655 	New_state(esp, ACTS_UNKNOWN);
   6656 
   6657 	switch (msgin) {
   6658 	case MSG_DISCONNECT:
   6659 		/*
   6660 		 * If we 'cannot' disconnect- reject this message.
   6661 		 * Note that we only key off of the pkt_flags here-
   6662 		 * it would be inappropriate to test against esp->e_scsi_options
   6663 		 * or esp->e_nodisc here (they might have been changed
   6664 		 * after this command started). I realize that this
   6665 		 * isn't complete coverage against this error, but it
   6666 		 * is the best we can do. I thought briefly about setting
   6667 		 * the FLAG_NODISCON bit in a packet
   6668 		 * if either of esp->e_scsi_options or esp->e_nodisc indicated
   6669 		 * that disconnect/reconnect has been turned off, but
   6670 		 * that might really bolix up the true owner of the
   6671 		 * packet (the target driver) who has really only
   6672 		 * *loaned* us this packet during transport.
   6673 		 */
   6674 		if (sp->cmd_pkt.pkt_flags & FLAG_NODISCON) {
   6675 			msgout = MSG_REJECT;
   6676 			break;
   6677 		}
   6678 		LOG_STATE(esp, ACTS_DISCONNECT, esp->e_stat, esp->e_xfer, -1);
   6679 		/* FALLTHROUGH */
   6680 	case MSG_COMMAND_COMPLETE:
   6681 		/* FALLTHROUGH */
   6682 	case MSG_LINK_CMPLT:
   6683 		/* FALLTHROUGH */
   6684 	case MSG_LINK_CMPLT_FLAG:
   6685 		esp->e_state = ACTS_CLEARING;
   6686 		LOG_STATE(esp, ACTS_MSG_IN, esp->e_stat, msgin, -1);
   6687 		break;
   6688 
   6689 	/* This has been taken care of above	*/
   6690 	/* case MSG_EXTENDED:			*/
   6691 
   6692 	case MSG_NOP:
   6693 		LOG_STATE(esp, ACTS_NOP, esp->e_stat, -1, -1);
   6694 		break;
   6695 
   6696 	case MSG_REJECT:
   6697 	{
   6698 		uchar_t reason = 0;
   6699 		uchar_t lastmsg = esp->e_last_msgout;
   6700 		/*
   6701 		 * The target is rejecting the last message we sent.
   6702 		 *
   6703 		 * If the last message we attempted to send out was an
   6704 		 * extended message, we were trying to negotiate sync
   6705 		 * xfers- and we're okay.
   6706 		 *
   6707 		 * Otherwise, a target has rejected a message that
   6708 		 * it should have handled. We will abort the operation
   6709 		 * in progress and set the pkt_reason value here to
   6710 		 * show why we have completed. The process of aborting
   6711 		 * may be via a message or may be via a bus reset (as
   6712 		 * a last resort).
   6713 		 */
   6714 		msgout = (TAGGED(tgt)? MSG_ABORT_TAG : MSG_ABORT);
   6715 		LOG_STATE(esp, ACTS_REJECT, esp->e_stat, -1, -1);
   6716 
   6717 		switch (lastmsg) {
   6718 		case MSG_EXTENDED:
   6719 			esp->e_sdtr = 0;
   6720 			esp->e_offset[tgt] = 0;
   6721 			esp->e_sync_known |= (1<<tgt);
   6722 			esp->e_weak |= (1<<tgt);
   6723 			msgout = 0;
   6724 			break;
   6725 
   6726 		case MSG_NOP:
   6727 			reason = CMD_NOP_FAIL;
   6728 			break;
   6729 		case MSG_INITIATOR_ERROR:
   6730 			reason = CMD_IDE_FAIL;
   6731 			break;
   6732 		case MSG_MSG_PARITY:
   6733 			reason = CMD_PER_FAIL;
   6734 			break;
   6735 		case MSG_REJECT:
   6736 			reason = CMD_REJECT_FAIL;
   6737 			break;
   6738 		case MSG_SIMPLE_QTAG:
   6739 		case MSG_ORDERED_QTAG:
   6740 		case MSG_HEAD_QTAG:
   6741 			msgout = MSG_ABORT;
   6742 			reason = CMD_TAG_REJECT;
   6743 			break;
   6744 		case MSG_DEVICE_RESET:
   6745 		case MSG_ABORT:
   6746 		case MSG_ABORT_TAG:
   6747 			/*
   6748 			 * If an RESET/ABORT OPERATION message is rejected
   6749 			 * it is time to yank the chain on the bus...
   6750 			 */
   6751 			reason = CMD_ABORT_FAIL;
   6752 			msgout = -ACTION_ABORT_CURCMD;
   6753 			break;
   6754 		default:
   6755 			if (IS_IDENTIFY_MSG(lastmsg)) {
   6756 				if (TAGGED(tgt)) {
   6757 					/*
   6758 					 * this often happens when the
   6759 					 * target rejected our tag
   6760 					 */
   6761 					reason = CMD_TAG_REJECT;
   6762 				} else {
   6763 					reason = CMD_ID_FAIL;
   6764 				}
   6765 			} else {
   6766 				reason = CMD_TRAN_ERR;
   6767 				msgout = -ACTION_ABORT_CURCMD;
   6768 			}
   6769 
   6770 			break;
   6771 		}
   6772 
   6773 		if (msgout) {
   6774 			esplog(esp, CE_WARN,
   6775 			    "Target %d rejects our message '%s'",
   6776 			    tgt, scsi_mname(lastmsg));
   6777 			if (sp->cmd_pkt.pkt_reason == CMD_CMPLT) {
   6778 				IPRINTF2("sp=0x%p, pkt_reason=%x\n",
   6779 				    (void *)sp, reason);
   6780 				sp->cmd_pkt.pkt_reason = reason;
   6781 			}
   6782 		}
   6783 		break;
   6784 	}
   6785 	case MSG_RESTORE_PTRS:
   6786 		if (sp->cmd_data_count != sp->cmd_saved_data_count) {
   6787 			if (esp_restore_pointers(esp, sp)) {
   6788 				msgout = -ACTION_ABORT_CURCMD;
   6789 			}
   6790 		}
   6791 		LOG_STATE(esp, ACTS_RESTOREDP, esp->e_stat, esp->e_xfer, -1);
   6792 		break;
   6793 
   6794 	case MSG_SAVE_DATA_PTR:
   6795 		sp->cmd_saved_data_count = sp->cmd_data_count;
   6796 		sp->cmd_saved_win  = sp->cmd_cur_win;
   6797 		sp->cmd_saved_cur_addr = sp->cmd_cur_addr;
   6798 		LOG_STATE(esp, ACTS_SAVEDP, esp->e_stat, esp->e_xfer, -1);
   6799 		break;
   6800 
   6801 	/* These don't make sense for us, and	*/
   6802 	/* will be rejected			*/
   6803 	/*	case MSG_INITIATOR_ERROR	*/
   6804 	/*	case MSG_ABORT			*/
   6805 	/*	case MSG_MSG_PARITY		*/
   6806 	/*	case MSG_DEVICE_RESET		*/
   6807 	default:
   6808 		msgout = MSG_REJECT;
   6809 		esplog(esp, CE_WARN,
   6810 		    "Rejecting message '%s' from Target %d",
   6811 		    scsi_mname(msgin), tgt);
   6812 		LOG_STATE(esp, ACTS_MSG_IN, esp->e_stat, msgin, -1);
   6813 		break;
   6814 	}
   6815 
   6816 	EPRINTF1("Message in: %s\n", scsi_mname(msgin));
   6817 
   6818 	return (msgout);
   6819 }
   6820 
   6821 /*
   6822  * phase handlers that are rarely used
   6823  */
   6824 static int
   6825 esp_handle_cmd_start(struct esp *esp)
   6826 {
   6827 	volatile struct espreg *ep = esp->e_reg;
   6828 	struct esp_cmd *sp = CURRENT_CMD(esp);
   6829 	int amt = sp->cmd_cdblen;
   6830 	uint_t cmd_distance;
   6831 
   6832 	TRACE_0(TR_FAC_SCSI, TR_ESP_HANDLE_CMD_START_START,
   6833 	    "esp_handle_cmd_start_start");
   6834 	EPRINTF("esp_handle_cmd:\n");
   6835 
   6836 	/*
   6837 	 * If the cmd is a defined scsi-2 cdb and it'll fit in our dma buffer,
   6838 	 * we'll use dma.  If not, we send it one byte at a time and take
   6839 	 * forever!
   6840 	 */
   6841 	if (amt > 0) {
   6842 		volatile caddr_t tp = (caddr_t)esp->e_cmdarea;
   6843 		int i;
   6844 
   6845 		EPRINTF("esp_handle_cmd: send cmd\n");
   6846 		for (i = 0; i < amt; i++) {
   6847 			*tp++ = sp->cmd_cdbp[i];
   6848 		}
   6849 		esp_flush_fifo(esp);
   6850 
   6851 		SET_DMAESC_COUNT(esp->e_dma, esp->e_esc_read_count);
   6852 		ESP_DMA_READ(esp, amt, esp->e_dmacookie.dmac_address);
   6853 
   6854 		Esp_cmd(esp, CMD_DMA | CMD_TRAN_INFO);
   6855 		esp->e_lastcount = amt;
   6856 		LOG_STATE(esp, ACTS_CMD, sp->cmd_cdbp[0], -1, -1);
   6857 	} else {
   6858 		/*
   6859 		 * Check for command overflow.
   6860 		 */
   6861 		cmd_distance =
   6862 		    (uintptr_t)sp->cmd_cdbp - (uintptr_t)sp->cmd_pkt.pkt_cdbp;
   6863 		if (cmd_distance >= (uint_t)CDB_GROUP5) {
   6864 			if (sp->cmd_pkt.pkt_reason == CMD_CMPLT)
   6865 				sp->cmd_pkt.pkt_reason = CMD_CMD_OVR;
   6866 			TRACE_0(TR_FAC_SCSI,
   6867 			    TR_ESP_HANDLE_CMD_START_ABORT_CMD_END,
   6868 			    "esp_handle_cmd_start_end (abort_cmd)");
   6869 			return (ACTION_ABORT_CURCMD);
   6870 		}
   6871 		if (cmd_distance == 0) {
   6872 			LOG_STATE(esp, ACTS_CMD_START, esp->e_stat,
   6873 			    sp->cmd_cdbp[0], -1);
   6874 		}
   6875 
   6876 		/*
   6877 		 * Stuff next command byte into fifo
   6878 		 */
   6879 		esp_flush_fifo(esp);
   6880 
   6881 		/* delay here: prevents problems with CDROM, see 1068706 */
   6882 		SET_ESP_COUNT(ep, 1);
   6883 		ep->esp_fifo_data = *(sp->cmd_cdbp++);
   6884 
   6885 		Esp_cmd(esp, CMD_TRAN_INFO);
   6886 	}
   6887 
   6888 	New_state(esp, ACTS_CMD_DONE);
   6889 	TRACE_0(TR_FAC_SCSI, TR_ESP_HANDLE_CMD_START_END,
   6890 	    "esp_handle_cmd_start_end");
   6891 	return (ACTION_RETURN);
   6892 }
   6893 
   6894 static int
   6895 esp_handle_cmd_done(struct esp *esp)
   6896 {
   6897 	struct esp_cmd *sp = CURRENT_CMD(esp);
   6898 	uchar_t intr = esp->e_intr;
   6899 
   6900 	TRACE_0(TR_FAC_SCSI, TR_ESP_HANDLE_CMD_DONE_START,
   6901 	    "esp_handle_cmd_done_start");
   6902 	EPRINTF("esp_handle_cmd_done\n");
   6903 
   6904 	/*
   6905 	 * The NOP command is required following a COMMAND
   6906 	 * or MESSAGE OUT phase in order to unlatch the
   6907 	 * FIFO flags register. This is needed for all
   6908 	 * ESP chip variants.
   6909 	 */
   6910 	Esp_cmd(esp, CMD_NOP);
   6911 
   6912 	/*
   6913 	 * We should have gotten a BUS SERVICE interrupt.
   6914 	 * If it isn't that, and it isn't a DISCONNECT
   6915 	 * interrupt, we have a "cannot happen" situation.
   6916 	 */
   6917 	if ((intr & ESP_INT_BUS) == 0) {
   6918 		if ((intr & ESP_INT_DISCON) == 0) {
   6919 			esp_printstate(esp, "cmd transmission error");
   6920 			TRACE_0(TR_FAC_SCSI, TR_ESP_HANDLE_CMD_DONE_ABORT1_END,
   6921 			    "esp_handle_cmd_done_end (abort1)");
   6922 			return (ACTION_ABORT_CURCMD);
   6923 		}
   6924 	} else {
   6925 		sp->cmd_pkt.pkt_state |= STATE_SENT_CMD;
   6926 	}
   6927 
   6928 	/*
   6929 	 * If we dma'ed out the cdb, we have a little cleanup to do...
   6930 	 */
   6931 	if (sp->cmd_cdblen > 0) {
   6932 		volatile struct dmaga *dmar = esp->e_dma;
   6933 		int amt, i;
   6934 
   6935 		esp->e_dmaga_csr = dmar->dmaga_csr;
   6936 		ESP_FLUSH_DMA(esp);
   6937 		amt = dmar->dmaga_addr - esp->e_lastdma;
   6938 
   6939 		if (ESP_DMAGA_REV(esp) != ESC1_REV1) {
   6940 			if ((i = DMAGA_NEXTBYTE(dmar)) != 0) {
   6941 				amt -= (4-i);
   6942 			}
   6943 		}
   6944 
   6945 		if (amt < esp->e_lastcount) {
   6946 			i = esp->e_lastcount - amt;
   6947 			esplog(esp, CE_WARN, "cmd dma error");
   6948 			TRACE_0(TR_FAC_SCSI, TR_ESP_HANDLE_CMD_DONE_ABORT2_END,
   6949 			    "esp_handle_cmd_done_end (abort2)");
   6950 			return (ACTION_ABORT_CURCMD);
   6951 		}
   6952 	}
   6953 
   6954 	New_state(esp, ACTS_UNKNOWN);
   6955 	TRACE_0(TR_FAC_SCSI, TR_ESP_HANDLE_CMD_DONE_END,
   6956 	    "esp_handle_cmd_done_end");
   6957 	return (esp_handle_unknown(esp));
   6958 }
   6959 
   6960 /*
   6961  * Begin to send a message out
   6962  */
   6963 static int
   6964 esp_handle_msg_out(struct esp *esp)
   6965 {
   6966 	struct esp_cmd *sp = CURRENT_CMD(esp);
   6967 	volatile struct espreg *ep = esp->e_reg;
   6968 	uchar_t *msgout = esp->e_cur_msgout;
   6969 	char amt = esp->e_omsglen;
   6970 
   6971 	TRACE_0(TR_FAC_SCSI, TR_ESP_HANDLE_MSG_OUT_START,
   6972 	    "esp_handle_msg_out_start");
   6973 	EPRINTF("esp_handle_msg_out\n");
   6974 
   6975 	/*
   6976 	 * Check to make *sure* that we are really
   6977 	 * in MESSAGE OUT phase. If the last state
   6978 	 * was ACTS_MSG_OUT_DONE, then we are trying
   6979 	 * to resend a message that the target stated
   6980 	 * had a parity error in it.
   6981 	 *
   6982 	 * If this is the case, and mark completion reason as CMD_NOMSGOUT.
   6983 	 * XXX: Right now, we just *drive* on. Should we abort the command?
   6984 	 */
   6985 	if ((esp->e_stat & ESP_PHASE_MASK) != ESP_PHASE_MSG_OUT &&
   6986 	    esp->e_laststate == ACTS_MSG_OUT_DONE) {
   6987 		esplog(esp, CE_WARN,
   6988 		    "Target %d refused message resend", Tgt(sp));
   6989 		if (sp->cmd_pkt.pkt_reason == CMD_CMPLT)
   6990 			sp->cmd_pkt.pkt_reason = CMD_NOMSGOUT;
   6991 		New_state(esp, ACTS_UNKNOWN);
   6992 		TRACE_0(TR_FAC_SCSI, TR_ESP_HANDLE_MSG_OUT_PHASEMANAGE_END,
   6993 		    "esp_handle_msg_out_end (ACTION_PHASEMANAGE)");
   6994 		return (ACTION_PHASEMANAGE);
   6995 	}
   6996 
   6997 	/*
   6998 	 * Clean the fifo.
   6999 	 */
   7000 	esp_flush_fifo(esp);
   7001 
   7002 	/*
   7003 	 * If msg only 1 byte, just dump it in the fifo and go.	 For
   7004 	 * multi-byte msgs, dma them to save time.  If we have no
   7005 	 * msg to send and we're in msg out phase, send a NOP.
   7006 	 *
   7007 	 * XXX: If target rejects synch. negotiate, we'll end up
   7008 	 *	having to send a nop msg because the esp chip doesn't
   7009 	 *	drop ATN* fast enough.
   7010 	 */
   7011 	if (amt == 1) {
   7012 		ep->esp_fifo_data = *msgout;
   7013 		ep->esp_cmd = CMD_TRAN_INFO;
   7014 
   7015 	} else if (amt > 1) {
   7016 		volatile caddr_t tp = (caddr_t)esp->e_cmdarea;
   7017 		char i;
   7018 
   7019 		for (i = 0; i < amt; i++)
   7020 			*tp++ = *msgout++;
   7021 		SET_DMAESC_COUNT(esp->e_dma, esp->e_esc_read_count);
   7022 		ESP_DMA_READ(esp, amt, esp->e_dmacookie.dmac_address);
   7023 
   7024 		Esp_cmd(esp, CMD_DMA | CMD_TRAN_INFO);
   7025 		esp->e_lastcount = amt;
   7026 	} else {
   7027 		/*
   7028 		 * this happens when the target reject the first byte
   7029 		 * of an extended msg such as synch negotiate
   7030 		 * (see also comment above)
   7031 		 */
   7032 		ep->esp_fifo_data = *msgout = MSG_NOP;
   7033 		esp->e_omsglen = 1;
   7034 		Esp_cmd(esp, CMD_TRAN_INFO);
   7035 	}
   7036 
   7037 	New_state(esp, ACTS_MSG_OUT_DONE);
   7038 	TRACE_0(TR_FAC_SCSI, TR_ESP_HANDLE_MSG_OUT_END,
   7039 	    "esp_handle_msg_out_end");
   7040 	return (ACTION_RETURN);
   7041 }
   7042 
   7043 static int
   7044 esp_handle_msg_out_done(struct esp *esp)
   7045 {
   7046 	struct esp_cmd *sp = CURRENT_CMD(esp);
   7047 	volatile struct espreg *ep = esp->e_reg;
   7048 	uchar_t msgout, phase, fifocnt;
   7049 	int target = Tgt(sp);
   7050 	int	amt = esp->e_omsglen;
   7051 	int action;
   7052 
   7053 	TRACE_0(TR_FAC_SCSI, TR_ESP_HANDLE_MSG_OUT_DONE_START,
   7054 	    "esp_handle_msg_out_done_start");
   7055 	msgout = esp->e_cur_msgout[0];
   7056 	if (msgout == MSG_HEAD_QTAG || msgout == MSG_SIMPLE_QTAG) {
   7057 		msgout = esp->e_cur_msgout[2];
   7058 	}
   7059 	EPRINTF4("msgout: %x %x %x, last_msgout=%x\n",
   7060 	    esp->e_cur_msgout[0], esp->e_cur_msgout[1],
   7061 	    esp->e_cur_msgout[2], esp->e_last_msgout);
   7062 
   7063 	EPRINTF1("esp_handle_msgout_done: msgout=%x\n", msgout);
   7064 
   7065 	/*
   7066 	 * If we dma'ed out the msg, we have a little cleanup to do...
   7067 	 */
   7068 	if (amt > 1) {
   7069 		volatile struct dmaga *dmar = esp->e_dma;
   7070 		int i;
   7071 
   7072 		esp->e_dmaga_csr = dmar->dmaga_csr;
   7073 		ESP_FLUSH_DMA(esp);
   7074 		amt = dmar->dmaga_addr - esp->e_lastdma;
   7075 		if (ESP_DMAGA_REV(esp) != ESC1_REV1) {
   7076 			if ((i = DMAGA_NEXTBYTE(dmar)) != 0) {
   7077 				amt -= (4-i);
   7078 			}
   7079 		}
   7080 		EPRINTF2("xfer= %d(%d)\n", amt, esp->e_lastcount);
   7081 	}
   7082 
   7083 	/*
   7084 	 * If the ESP disconnected, then the message we sent caused
   7085 	 * the target to decide to drop BSY* and clear the bus.
   7086 	 */
   7087 	if (esp->e_intr == ESP_INT_DISCON) {
   7088 		if (msgout == MSG_DEVICE_RESET || msgout == MSG_ABORT ||
   7089 		    msgout == MSG_ABORT_TAG) {
   7090 			esp_chip_disconnect(esp, sp);
   7091 			/*
   7092 			 * If we sent a device reset msg, then we need to do
   7093 			 * a synch negotiate again unless we have already
   7094 			 * inhibited synch.
   7095 			 */
   7096 			if (msgout == MSG_ABORT || msgout == MSG_ABORT_TAG) {
   7097 				esp->e_abort++;
   7098 				if ((sp->cmd_flags & CFLAG_CMDPROXY) == 0) {
   7099 					MARK_PKT(sp, CMD_ABORTED, STAT_ABORTED);
   7100 				}
   7101 			} else if (msgout == MSG_DEVICE_RESET) {
   7102 				esp->e_reset++;
   7103 				if ((sp->cmd_flags & CFLAG_CMDPROXY) == 0) {
   7104 					MARK_PKT(sp, CMD_RESET, STAT_DEV_RESET);
   7105 				}
   7106 				esp->e_offset[target] = 0;
   7107 				esp->e_sync_known &= ~(1<<target);
   7108 			}
   7109 			EPRINTF2("Successful %s message to target %d\n",
   7110 			    scsi_mname(msgout), target);
   7111 
   7112 			if (sp->cmd_flags & CFLAG_CMDPROXY) {
   7113 				sp->cmd_cdb[ESP_PROXY_RESULT] = TRUE;
   7114 			}
   7115 			TRACE_0(TR_FAC_SCSI,
   7116 			    TR_ESP_HANDLE_MSG_OUT_DONE_FINISH_END,
   7117 			    "esp_handle_msg_out_done_end (ACTION_FINISH)");
   7118 			return (ACTION_FINISH);
   7119 		}
   7120 		/*
   7121 		 * If the target dropped busy on any other message, it
   7122 		 * wasn't expected. We will let the code in esp_phasemanage()
   7123 		 * handle this unexpected bus free event.
   7124 		 */
   7125 		goto out;
   7126 	}
   7127 
   7128 	/*
   7129 	 * What phase have we transitioned to?
   7130 	 */
   7131 	phase = esp->e_stat & ESP_PHASE_MASK;
   7132 
   7133 	/*
   7134 	 * Save current fifo count
   7135 	 */
   7136 	fifocnt = FIFO_CNT(ep);
   7137 
   7138 	/*
   7139 	 * As per the ESP errata sheets, this must be done for
   7140 	 * all ESP chip variants.
   7141 	 *
   7142 	 * This releases the FIFO counter from its latched state.
   7143 	 * Note that we read the fifo counter above prior to doing
   7144 	 * this.
   7145 	 */
   7146 	Esp_cmd(esp, CMD_NOP);
   7147 
   7148 	/*
   7149 	 * Clean the fifo? Yes, if and only if we haven't
   7150 	 * transitioned to Synchronous DATA IN phase.
   7151 	 * The ESP chip manual notes that in the case
   7152 	 * that the target has shifted to Synchronous
   7153 	 * DATA IN phase, that while the FIFO count
   7154 	 * register stays latched up with the number
   7155 	 * of bytes not transferred out, that the fifo
   7156 	 * itself is cleared and will contain only
   7157 	 * the incoming data bytes.
   7158 	 *
   7159 	 * The manual doesn't state what happens in
   7160 	 * other receive cases (transition to STATUS,
   7161 	 * MESSAGE IN, or asynchronous DATA IN phase),
   7162 	 * but I'll assume that there is probably
   7163 	 * a single-byte pad between the fifo and
   7164 	 * the SCSI bus which the ESP uses to hold
   7165 	 * the currently asserted data on the bus
   7166 	 * (known valid by a true REQ* signal). In
   7167 	 * the case of synchronous data in, up to
   7168 	 * 15 bytes of data could arrive, so the
   7169 	 * ESP must have to make room for by clearing
   7170 	 * the fifo, but in other cases it can just
   7171 	 * hold the current byte until the next
   7172 	 * ESP chip command that would cause a
   7173 	 * data transfer.
   7174 	 * XXX STILL NEEDED????
   7175 	 */
   7176 	if (fifocnt != 0 && (phase != ESP_PHASE_DATA_IN ||
   7177 	    esp->e_offset[target] == 0)) {
   7178 		esp_flush_fifo(esp);
   7179 	}
   7180 
   7181 	/*
   7182 	 * If we finish sending a message out, and we are
   7183 	 * still in message out phase, then the target has
   7184 	 * detected one or more parity errors in the message
   7185 	 * we just sent and it is asking us to resend the
   7186 	 * previous message.
   7187 	 */
   7188 	if ((esp->e_intr & ESP_INT_BUS) && phase == ESP_PHASE_MSG_OUT) {
   7189 		/*
   7190 		 * As per SCSI-2 specification, if the message to
   7191 		 * be re-sent is greater than one byte, then we
   7192 		 * have to set ATN*.
   7193 		 */
   7194 		if (amt > 1) {
   7195 			Esp_cmd(esp, CMD_SET_ATN);
   7196 		}
   7197 		esplog(esp, CE_WARN,
   7198 		    "SCSI bus MESSAGE OUT phase parity error");
   7199 		sp->cmd_pkt.pkt_statistics |= STAT_PERR;
   7200 		New_state(esp, ACTS_MSG_OUT);
   7201 		TRACE_0(TR_FAC_SCSI, TR_ESP_HANDLE_MSG_OUT_DONE_PHASEMANAGE_END,
   7202 		    "esp_handle_msg_out_done_end (ACTION_PHASEMANAGE)");
   7203 		return (ACTION_PHASEMANAGE);
   7204 	}
   7205 
   7206 	/*
   7207 	 * Count that we sent a SYNCHRONOUS DATA TRANSFER message.
   7208 	 * (allow for a tag message before the sdtr msg)
   7209 	 */
   7210 	if (((esp->e_omsglen == 5 && msgout == MSG_EXTENDED &&
   7211 	    esp->e_cur_msgout[2] == MSG_SYNCHRONOUS)) ||
   7212 	    ((esp->e_omsglen == 7 &&
   7213 	    esp->e_cur_msgout[2] == MSG_EXTENDED &&
   7214 	    esp->e_cur_msgout[4] == MSG_SYNCHRONOUS))) {
   7215 		esp->e_sdtr++;
   7216 	}
   7217 
   7218 out:
   7219 	esp->e_last_msgout = msgout;
   7220 	esp->e_omsglen = 0;
   7221 	New_state(esp, ACTS_UNKNOWN);
   7222 	action = esp_handle_unknown(esp);
   7223 	TRACE_0(TR_FAC_SCSI, TR_ESP_HANDLE_MSG_OUT_DONE_END,
   7224 	    "esp_handle_msg_out_done_end");
   7225 	return (action);
   7226 }
   7227 
   7228 
   7229 static int
   7230 esp_twobyte_msg(struct esp *esp)
   7231 {
   7232 	esplog(esp, CE_WARN,
   7233 	    "Two byte message '%s' 0x%x rejected",
   7234 	    scsi_mname(esp->e_imsgarea[0]), esp->e_imsgarea[1]);
   7235 	return (MSG_REJECT);
   7236 }
   7237 
   7238 /*
   7239  * esp_update_props creates/modifies/removes a target sync mode speed
   7240  * property containing tickval (KB/sec in hex)
   7241  * If offset is 0 then asynchronous mode is assumed and the property
   7242  * is removed
   7243  */
   7244 static void
   7245 esp_update_props(struct esp *esp, int tgt)
   7246 {
   7247 	static char *prop_template = "target%d-sync-speed";
   7248 	char property[32];
   7249 	dev_info_t *dip = esp->e_dev;
   7250 	uint_t offset = esp->e_offset[tgt];
   7251 	uint_t regval = esp->e_period[tgt];
   7252 	uint_t tickval;
   7253 
   7254 	if (offset) {
   7255 		/*
   7256 		 * Convert input clock cycle per
   7257 		 * byte to nanoseconds per byte.
   7258 		 * (ns/b), and convert that to
   7259 		 * k-bytes/second.
   7260 		 */
   7261 
   7262 		tickval = ESP_SYNC_KBPS((regval *
   7263 		    esp->e_clock_cycle) / 1000);
   7264 	} else {
   7265 		tickval = 0;
   7266 	}
   7267 	ASSERT(mutex_owned(ESP_MUTEX));
   7268 	/*
   7269 	 * We cannot hold any mutex at this point because the call to
   7270 	 * ddi_prop_update_int, ddi_prop_remove  may block.
   7271 	 */
   7272 	mutex_exit(ESP_MUTEX);
   7273 	(void) sprintf(property, prop_template, tgt);
   7274 	if (ddi_prop_exists(DDI_DEV_T_ANY, dip, DDI_PROP_DONTPASS, property)) {
   7275 		if (offset == 0) {
   7276 			/*
   7277 			 * if target was switched back to async mode,
   7278 			 * remove property
   7279 			 */
   7280 			if (ddi_prop_remove(DDI_DEV_T_NONE, dip, property) !=
   7281 			    DDI_PROP_SUCCESS) {
   7282 				IPRINTF1("cannot remove %s property\n",
   7283 				    property);
   7284 			}
   7285 			mutex_enter(ESP_MUTEX);
   7286 			return;
   7287 		}
   7288 	}
   7289 	if (offset != 0) {
   7290 		if (ddi_prop_update_int(DDI_DEV_T_NONE, dip, property,
   7291 		    (int)tickval) != DDI_PROP_SUCCESS) {
   7292 			IPRINTF1("cannot create %s property\n", property);
   7293 		}
   7294 	}
   7295 	mutex_enter(ESP_MUTEX);
   7296 }
   7297 
   7298 static int
   7299 esp_multibyte_msg(struct esp *esp)
   7300 {
   7301 #ifdef ESPDEBUG
   7302 /*
   7303  * XXX: Should be able to use %d.03%d instead of three different messages.
   7304  */
   7305 	static char *mbs =
   7306 	    "Target %d now Synchronous at %d.%d MB/s max transmit rate\n";
   7307 	static char *mbs1 =
   7308 	    "Target %d now Synchronous at %d.0%d MB/s max transmit rate\n";
   7309 	static char *mbs2 =
   7310 	    "Target %d now Synchronous at %d.00%d MB/s max transmit rate\n";
   7311 #endif
   7312 	struct esp_cmd *sp = CURRENT_CMD(esp);
   7313 	volatile struct espreg *ep = esp->e_reg;
   7314 	uchar_t emsg = esp->e_imsgarea[2];
   7315 	int tgt = Tgt(sp);
   7316 	int msgout = 0;
   7317 
   7318 	EPRINTF("esp_multibyte_msg:\n");
   7319 
   7320 	if (emsg == MSG_SYNCHRONOUS) {
   7321 		uint_t period, offset, regval;
   7322 		uint_t minsync, maxsync, clockval;
   7323 
   7324 		period = esp->e_imsgarea[3]&0xff;
   7325 		offset = esp->e_imsgarea[4]&0xff;
   7326 		minsync = MIN_SYNC_PERIOD(esp);
   7327 		maxsync = MAX_SYNC_PERIOD(esp);
   7328 		EPRINTF3("received period %d offset %d from tgt %d\n",
   7329 		    period, offset, tgt);
   7330 		EPRINTF3("calculated minsync %d, maxsync %d for tgt %d\n",
   7331 		    minsync, maxsync, tgt);
   7332 
   7333 		if ((++(esp->e_sdtr)) & 1) {
   7334 			/*
   7335 			 * In cases where the target negotiates synchronous
   7336 			 * mode before we do, and we either have sync mode
   7337 			 * disbled, or this target is known to be a weak
   7338 			 * signal target, we send back a message indicating
   7339 			 * a desire to stay in asynchronous mode (the SCSI-2
   7340 			 * spec states that if we have synchronous capability
   7341 			 * that we cannot reject a SYNCHRONOUS DATA TRANSFER
   7342 			 * REQUEST message).
   7343 			 */
   7344 			IPRINTF1("SYNC neg. initiated by tgt %d:\n", tgt);
   7345 			IPRINTF2("period=%x, offset=%x\n", period, offset);
   7346 			msgout = MSG_EXTENDED;
   7347 			period = max(period, esp->e_default_period[tgt]);
   7348 			offset = min(DEFAULT_OFFSET, offset);
   7349 
   7350 			if ((esp->e_weak & (1<<tgt)) ||
   7351 			    (esp->e_target_scsi_options[tgt] &
   7352 			    SCSI_OPTIONS_SYNC) == 0) {
   7353 				/*
   7354 				 * Only zero out the offset. Don't change
   7355 				 * the period.
   7356 				 */
   7357 				esp_make_sdtr(esp, 0, (int)period, 0);
   7358 				IPRINTF("sending async back\n");
   7359 				esp->e_neg_period[tgt] = 0;
   7360 				esp->e_period[tgt] = 0;
   7361 				esp->e_offset[tgt] = 0;
   7362 				esp->e_espconf3_last = esp->e_period_last =
   7363 				    esp->e_offset_last = (uchar_t)-1;
   7364 				goto out;
   7365 			}
   7366 			if (esp->e_backoff[tgt] == 1) {
   7367 				period = max(period, esp->e_neg_period[tgt]);
   7368 			} else if (esp->e_backoff[tgt] > 1) {
   7369 				period = max(period, esp->e_neg_period[tgt]);
   7370 				offset = 0;
   7371 			}
   7372 		}
   7373 
   7374 		regval = 0;
   7375 
   7376 		/*
   7377 		 * If the target's offset is bigger than ours,
   7378 		 * the target has violated the scsi protocol.
   7379 		 */
   7380 		if (offset > DEFAULT_OFFSET) {
   7381 			period = offset = 0;
   7382 			msgout = MSG_REJECT;
   7383 			goto out;
   7384 		}
   7385 
   7386 		if (offset && period > maxsync) {
   7387 			/*
   7388 			 * We cannot transmit data in synchronous
   7389 			 * mode this slow, so convert to asynchronous
   7390 			 * mode.
   7391 			 */
   7392 			msgout = MSG_EXTENDED;
   7393 			esp_make_sdtr(esp, 0, (int)period, 0);
   7394 			goto out;
   7395 
   7396 		} else if (offset && period < minsync) {
   7397 			/*
   7398 			 * If the target's period is less than ours,
   7399 			 * the target has violated the scsi protocol.
   7400 			 */
   7401 			period = offset = 0;
   7402 			msgout = MSG_REJECT;
   7403 			goto out;
   7404 
   7405 		} else if (offset) {
   7406 			/*
   7407 			 * Conversion method for received PERIOD value
   7408 			 * to the number of input clock ticks to the ESP.
   7409 			 *
   7410 			 * We adjust the input period value such that
   7411 			 * we always will transmit data *not* faster
   7412 			 * than the period value received.
   7413 			 */
   7414 
   7415 			clockval = esp->e_clock_cycle / 1000;
   7416 			regval = (((period << 2) + clockval - 1) / clockval);
   7417 
   7418 			/*
   7419 			 * correct for FAS if xfer rate <= 5MB/sec
   7420 			 */
   7421 			if (regval && (esp->e_options & ESP_OPT_FAS)) {
   7422 				if (period >= FASTSCSI_THRESHOLD) {
   7423 					regval--;
   7424 				}
   7425 			}
   7426 
   7427 			/*
   7428 			 * Strictly paranoia!
   7429 			 */
   7430 			if (regval > MAX_SYNC(esp)) {
   7431 				msgout = MSG_EXTENDED;
   7432 				esp_make_sdtr(esp, 0, (int)period, 0);
   7433 				goto out;
   7434 			}
   7435 		}
   7436 
   7437 		esp->e_neg_period[tgt] = period;
   7438 		esp->e_offset[tgt] = offset;
   7439 
   7440 		if (offset) {
   7441 			esp->e_period[tgt] =
   7442 			    esp->e_period_last = ep->esp_sync_period =
   7443 			    regval & SYNC_PERIOD_MASK;
   7444 
   7445 			esp->e_offset_last = ep->esp_sync_offset =
   7446 			    esp->e_offset[tgt] = offset | esp->e_req_ack_delay;
   7447 
   7448 			if (esp->e_options & ESP_OPT_FAS) {
   7449 				/*
   7450 				 * if transferring > 5 MB/sec then enable
   7451 				 * fastscsi in conf3
   7452 				 */
   7453 				if (period < FASTSCSI_THRESHOLD) {
   7454 					esp->e_espconf3[tgt] |=
   7455 					    esp->e_espconf3_fastscsi;
   7456 				} else {
   7457 					esp->e_espconf3[tgt] &=
   7458 					    ~esp->e_espconf3_fastscsi;
   7459 				}
   7460 				esp->e_espconf3_last =
   7461 				    ep->esp_conf3 = esp->e_espconf3[tgt];
   7462 			}
   7463 
   7464 			EPRINTF4(
   7465 			    "sending period %d (%d), offset %d to tgt %d\n",
   7466 			    period, esp->e_period[tgt] & SYNC_PERIOD_MASK,
   7467 			    esp->e_offset[tgt] & 0xf, tgt);
   7468 			EPRINTF1("req/ack delay = %x\n", esp->e_req_ack_delay);
   7469 			EPRINTF1("conf3 = %x\n", esp->e_espconf3[tgt]);
   7470 
   7471 #ifdef ESPDEBUG
   7472 		{
   7473 			uint_t xfer_freq, xfer_div, xfer_mod;
   7474 			/*
   7475 			 * Convert input clock cycle per
   7476 			 * byte to nanoseconds per byte.
   7477 			 * (ns/b), and convert that to
   7478 			 * k-bytes/second.
   7479 			 */
   7480 			xfer_freq = ESP_SYNC_KBPS((regval *
   7481 			    esp->e_clock_cycle) / 1000);
   7482 			xfer_div = xfer_freq / 1000;
   7483 			xfer_mod = xfer_freq % 1000;
   7484 
   7485 
   7486 			if (xfer_mod > 99) {
   7487 				IPRINTF3(mbs, tgt, xfer_div, xfer_mod);
   7488 			} else if (xfer_mod > 9) {
   7489 				IPRINTF3(mbs1, tgt, xfer_div, xfer_mod);
   7490 			} else {
   7491 				IPRINTF3(mbs2, tgt, xfer_div, xfer_mod);
   7492 			}
   7493 		}
   7494 #endif /* ESPDEBUG */
   7495 		} else {
   7496 			/*
   7497 			 * We are converting back to async mode.
   7498 			 */
   7499 			esp->e_period_last = ep->esp_sync_period =
   7500 			    esp->e_period[tgt] = 0;
   7501 			esp->e_offset_last = ep->esp_sync_offset =
   7502 			    esp->e_offset[tgt] = 0;
   7503 			esp->e_espconf3[tgt] &= ~esp->e_espconf3_fastscsi;
   7504 			esp->e_espconf3_last =
   7505 			    ep->esp_conf3 = esp->e_espconf3[tgt];
   7506 		}
   7507 
   7508 		if (msgout) {
   7509 			esp_make_sdtr(esp, 0, (int)period, (int)offset);
   7510 		}
   7511 		esp->e_sync_known |= (1<<tgt);
   7512 
   7513 		esp->e_props_update |= (1<<tgt);
   7514 
   7515 	} else if (emsg == MSG_MODIFY_DATA_PTR) {
   7516 		msgout = MSG_REJECT;
   7517 	} else {
   7518 		if (emsg != MSG_WIDE_DATA_XFER) {
   7519 			esplog(esp, CE_WARN,
   7520 			    "Rejecting message %s 0x%x from Target %d",
   7521 			    scsi_mname(MSG_EXTENDED), emsg, tgt);
   7522 		} else {
   7523 			IPRINTF3(
   7524 			    "Rejecting message %s 0x%x from Target %d",
   7525 			    scsi_mname(MSG_EXTENDED), emsg, tgt);
   7526 		}
   7527 		msgout = MSG_REJECT;
   7528 	}
   7529 out:
   7530 	New_state(esp, ACTS_UNKNOWN);
   7531 	return (msgout);
   7532 }
   7533 
   7534 static int
   7535 esp_handle_selection(struct esp *esp)
   7536 {
   7537 	Esp_cmd(esp, CMD_DISCONNECT);
   7538 	return (ACTION_RETURN);
   7539 }
   7540 
   7541 /*
   7542  * dma window handling
   7543  */
   7544 static int
   7545 esp_restore_pointers(struct esp *esp, struct esp_cmd *sp)
   7546 {
   7547 	if (sp->cmd_data_count != sp->cmd_saved_data_count) {
   7548 		sp->cmd_data_count = sp->cmd_saved_data_count;
   7549 		sp->cmd_cur_addr = sp->cmd_saved_cur_addr;
   7550 
   7551 		if (sp->cmd_cur_win != sp->cmd_saved_win) {
   7552 			sp->cmd_cur_win = sp->cmd_saved_win;
   7553 			if (esp_set_new_window(esp, sp)) {
   7554 				return (-1);
   7555 			}
   7556 		}
   7557 		IPRINTF1("curaddr=%x\n", sp->cmd_cur_addr);
   7558 	}
   7559 	return (0);
   7560 }
   7561 
   7562 static int
   7563 esp_set_new_window(struct esp *esp, struct esp_cmd *sp)
   7564 {
   7565 	off_t offset;
   7566 	size_t len;
   7567 	uint_t count;
   7568 
   7569 	if (ddi_dma_getwin(sp->cmd_dmahandle, sp->cmd_cur_win,
   7570 	    &offset, &len, &sp->cmd_dmacookie, &count) != DDI_SUCCESS) {
   7571 		return (-1);
   7572 	}
   7573 
   7574 	IPRINTF4("new window %x: off=%lx, len=%lx, count=%x\n",
   7575 	    sp->cmd_cur_win, offset, len, count);
   7576 
   7577 	ASSERT(count == 1);
   7578 	return (0);
   7579 }
   7580 
   7581 static int
   7582 esp_next_window(struct esp *esp, struct esp_cmd *sp)
   7583 {
   7584 
   7585 	/* are there more windows? */
   7586 	if (sp->cmd_nwin == 0) {
   7587 		uint_t nwin = 0;
   7588 		(void) ddi_dma_numwin(sp->cmd_dmahandle, &nwin);
   7589 		sp->cmd_nwin = (uchar_t)nwin;
   7590 	}
   7591 
   7592 	IPRINTF4(
   7593 	    "cmd_data_count=%x, dmacount=%x, curaddr=%x, nwin=%x\n",
   7594 	    sp->cmd_data_count, sp->cmd_dmacount, sp->cmd_cur_addr,
   7595 	    sp->cmd_nwin);
   7596 
   7597 	/*
   7598 	 * if there are no more windows, we have a data overrun condition
   7599 	 */
   7600 	if (++sp->cmd_cur_win >= sp->cmd_nwin) {
   7601 		int slot = Tgt(sp) * NTARGETS | Lun(sp);
   7602 
   7603 		esp_printstate(esp, "data transfer overrun");
   7604 
   7605 		if (sp->cmd_pkt.pkt_reason == CMD_CMPLT) {
   7606 			sp->cmd_pkt.pkt_reason = CMD_DATA_OVR;
   7607 		}
   7608 		/*
   7609 		 * A fix for bug id 1048141- if we get data transfer
   7610 		 * overruns, assume we have a weak scsi bus. Note that
   7611 		 * this won't catch consistent underruns or other
   7612 		 * noise related syndromes.
   7613 		 */
   7614 		esp_sync_backoff(esp, sp, slot);
   7615 		return (-1);
   7616 
   7617 	} else {
   7618 		if (esp_set_new_window(esp, sp)) {
   7619 			sp->cmd_cur_win--;
   7620 			return (-1);
   7621 		}
   7622 	}
   7623 	sp->cmd_cur_addr = sp->cmd_dmacookie.dmac_address;
   7624 	IPRINTF1("cur_addr=%x\n", sp->cmd_cur_addr);
   7625 	return (0);
   7626 }
   7627 
   7628 /*
   7629  * dma error checking
   7630  */
   7631 static int
   7632 esp_check_dma_error(struct esp *esp)
   7633 {
   7634 	/*
   7635 	 * was there a dmaga error that caused espsvc() to be called?
   7636 	 */
   7637 	if (esp->e_dma->dmaga_csr & DMAGA_ERRPEND) {
   7638 		/*
   7639 		 * It would be desirable to set the ATN* line and attempt to
   7640 		 * do the whole schmear of INITIATOR DETECTED ERROR here,
   7641 		 * but that is too hard to do at present.
   7642 		 */
   7643 		esp_printstate(esp, "dma error");
   7644 		esplog(esp, CE_WARN, "Unrecoverable DMA error on dma");
   7645 		if (esp->e_cur_slot != UNDEFINED) {
   7646 			struct esp_cmd *sp = CURRENT_CMD(esp);
   7647 			if (sp->cmd_pkt.pkt_reason == CMD_CMPLT)
   7648 				sp->cmd_pkt.pkt_reason = CMD_TRAN_ERR;
   7649 		}
   7650 		return (-1);
   7651 	}
   7652 	return (0);
   7653 }
   7654 
   7655 /*
   7656  * run a polled cmd
   7657  */
   7658 static void
   7659 esp_runpoll(struct esp *esp, short slot, struct esp_cmd *sp)
   7660 {
   7661 	int limit, i, n;
   7662 	int timeout = 0;
   7663 
   7664 	IPRINTF4("runpoll: slot=%x, cmd=%x, e_slots=0x%p, tcmds=%x\n",
   7665 	    slot, *((uchar_t *)sp->cmd_pkt.pkt_cdbp),
   7666 	    (void *)esp->e_slots[slot], esp->e_tcmds[slot]);
   7667 
   7668 	TRACE_0(TR_FAC_SCSI, TR_ESP_RUNPOLL_START, "esp_runpoll_start");
   7669 
   7670 	/*
   7671 	 * wait for cmd to complete
   7672 	 * don't start new cmds so set throttles to HOLD_THROTTLE
   7673 	 */
   7674 	while ((sp->cmd_flags & CFLAG_COMPLETED) == 0) {
   7675 		struct esp_cmd *savesp = esp->e_slots[slot];
   7676 
   7677 		esp_check_in_transport(esp, NULL);
   7678 
   7679 		if (savesp) {
   7680 			ASSERT(savesp->cmd_flags & CFLAG_IN_TRANSPORT);
   7681 		}
   7682 
   7683 		esp_set_all_lun_throttles(esp, slot, HOLD_THROTTLE);
   7684 		if ((esp->e_state != STATE_FREE) || INTPENDING(esp)) {
   7685 			if (esp_dopoll(esp, POLL_TIMEOUT) <= 0) {
   7686 				IPRINTF("runpoll: timeout on draining\n");
   7687 				goto bad;
   7688 			}
   7689 		}
   7690 
   7691 		/*
   7692 		 * if this is not a proxy cmd, don't start the cmd
   7693 		 * without draining the active cmd(s)
   7694 		 * for proxy cmds, we zap the active cmd and assume
   7695 		 * that the caller will take care of this
   7696 		 * For tagged cmds, wait with submitting a non-tagged
   7697 		 * cmd until the queue has been drained
   7698 		 * If the cmd is a request sense, then draining won't
   7699 		 * help since we are in contingence allegiance condition
   7700 		 * XXX this shouldn't really be necessary but it is
   7701 		 * safer
   7702 		 */
   7703 		if (!(sp->cmd_flags & CFLAG_CMDPROXY)) {
   7704 			uchar_t *cmdp = (uchar_t *)sp->cmd_pkt.pkt_cdbp;
   7705 			if (((esp->e_slots[slot] != NULL) &&
   7706 			    (sp != esp->e_slots[slot])) ||
   7707 			    (((sp->cmd_pkt.pkt_flags & FLAG_TAGMASK) == 0) &&
   7708 			    TAGGED(Tgt(sp)) && esp->e_tcmds[slot]) &&
   7709 			    (*cmdp != SCMD_REQUEST_SENSE)) {
   7710 				if (timeout < POLL_TIMEOUT) {
   7711 					timeout += 100;
   7712 					drv_usecwait(100);
   7713 					continue;
   7714 				} else {
   7715 					esplog(esp, CE_WARN,
   7716 					    "polled cmd failed (target busy)");
   7717 					goto cleanup;
   7718 				}
   7719 			}
   7720 			ASSERT((esp->e_slots[slot] == NULL) ||
   7721 			    (esp->e_slots[slot] == sp));
   7722 		}
   7723 
   7724 		/*
   7725 		 * If the draining of active commands killed the
   7726 		 * the current polled command, we're done..
   7727 		 * XXX this is not very likely
   7728 		 */
   7729 		if (sp->cmd_flags & CFLAG_COMPLETED) {
   7730 			break;
   7731 		}
   7732 
   7733 		/*
   7734 		 * ensure we are not accessing a target too quickly
   7735 		 * after a reset. the throttles get set back later
   7736 		 * by the reset delay watch; hopefully, we don't go
   7737 		 * thru this loop more than once
   7738 		 */
   7739 		if (esp->e_reset_delay[slot/NLUNS_PER_TARGET]) {
   7740 			IPRINTF1("reset delay set for slot %x\n", slot);
   7741 			drv_usecwait(esp->e_scsi_reset_delay * 1000);
   7742 			for (i = 0; i < NTARGETS; i++) {
   7743 				if (esp->e_reset_delay[i]) {
   7744 					int s = i * NLUNS_PER_TARGET;
   7745 					int e = s + NLUNS_PER_TARGET;
   7746 					esp->e_reset_delay[i] = 0;
   7747 					for (; s < e; s++) {
   7748 						esp->e_throttle[s] =
   7749 						    CLEAR_THROTTLE;
   7750 					}
   7751 				}
   7752 			}
   7753 		}
   7754 
   7755 		/*
   7756 		 * the draining should have cleaned everything up
   7757 		 */
   7758 		ASSERT(esp->e_state == STATE_FREE);
   7759 		if (esp->e_slots[slot] && (esp->e_slots[slot] != sp)) {
   7760 			ASSERT(savesp == esp->e_slots[slot]);
   7761 			ASSERT(savesp->cmd_flags & CFLAG_CMDDISC);
   7762 			ASSERT(savesp->cmd_flags & CFLAG_IN_TRANSPORT);
   7763 
   7764 			/* adjust the counts since this cmd is now gone */
   7765 			esp_decrement_ncmds(esp, savesp);
   7766 			/*
   7767 			 * set finished flag so the counts won't get
   7768 			 * decremented again for this cmd
   7769 			 */
   7770 			savesp->cmd_flags |= CFLAG_FINISHED;
   7771 		}
   7772 
   7773 		esp->e_slots[slot] = sp;
   7774 		esp->e_cur_slot = slot;
   7775 		ASSERT(sp->cmd_flags & CFLAG_IN_TRANSPORT);
   7776 
   7777 		/* make sure the throttles are still on hold */
   7778 		esp_set_all_lun_throttles(esp, slot, HOLD_THROTTLE);
   7779 
   7780 		/*
   7781 		 * esp_startcmd() will return false if preempted and will
   7782 		 * not service the interrupt if NOINTR cmd
   7783 		 * if this cmd was a non-tagged cmd for a tagged cmd
   7784 		 * esp_startcmd will also return false
   7785 		 */
   7786 		if (esp_startcmd(esp, sp) != TRUE) {
   7787 			continue;
   7788 		}
   7789 
   7790 		/*
   7791 		 * We're now 'running' this command.
   7792 		 *
   7793 		 * esp_dopoll will always return when
   7794 		 * esp->e_state is STATE_FREE, and
   7795 		 */
   7796 		ASSERT(sp != 0);
   7797 		ASSERT(sp == esp->e_slots[slot]);
   7798 		limit = sp->cmd_pkt.pkt_time * 1000000;
   7799 		if (limit == 0) {
   7800 			limit = POLL_TIMEOUT;
   7801 		}
   7802 
   7803 		/*
   7804 		 * if the cmd disconnected, the first call to esp_dopoll
   7805 		 * will return with bus free; we go thru the loop one more
   7806 		 * time and wait limit usec for the target to reconnect
   7807 		 */
   7808 		for (i = 0; i <= POLL_TIMEOUT; i += 100) {
   7809 
   7810 			if ((n = esp_dopoll(esp, limit)) <= 0) {
   7811 				IPRINTF("runpoll: timeout on polling\n");
   7812 				goto bad;
   7813 			}
   7814 
   7815 			/*
   7816 			 * If a preemption occurred that caused this
   7817 			 * command to actually not start, go around
   7818 			 * the loop again. If CFLAG_COMPLETED is set, the
   7819 			 * command completed
   7820 			 */
   7821 			if ((sp->cmd_flags & CFLAG_COMPLETED) ||
   7822 			    (sp->cmd_pkt.pkt_state == 0)) {
   7823 				break;
   7824 			}
   7825 
   7826 			/*
   7827 			 * the bus may have gone free because the target
   7828 			 * disconnected; go thru the loop again
   7829 			 */
   7830 			ASSERT(esp->e_state == STATE_FREE);
   7831 			if (n == 0) {
   7832 				/*
   7833 				 * bump i, we have waited limit usecs in
   7834 				 * esp_dopoll
   7835 				 */
   7836 				i += limit - 100;
   7837 			}
   7838 		}
   7839 
   7840 		if ((sp->cmd_flags & CFLAG_COMPLETED) == 0) {
   7841 
   7842 			if (i > POLL_TIMEOUT) {
   7843 				IPRINTF("polled timeout on disc. cmd\n");
   7844 				goto bad;
   7845 			}
   7846 
   7847 			if (sp->cmd_pkt.pkt_state) {
   7848 				/*
   7849 				 * don't go thru the loop again; the cmd
   7850 				 * was already started
   7851 				 */
   7852 				IPRINTF("esp_runpoll: cmd started??\n");
   7853 				goto bad;
   7854 			}
   7855 		}
   7856 	}
   7857 
   7858 	esp_check_in_transport(esp, NULL);
   7859 
   7860 	/*
   7861 	 * blindly restore throttles which is preferable over
   7862 	 * leaving throttle hanging at HOLD_THROTTLE and none to clear it
   7863 	 */
   7864 	esp_set_all_lun_throttles(esp, slot, CLEAR_THROTTLE);
   7865 
   7866 
   7867 	/*
   7868 	 * If we stored up commands to do, start them off now.
   7869 	 */
   7870 	if ((esp->e_state == STATE_FREE) &&
   7871 	    (!(sp->cmd_flags & CFLAG_CMDPROXY))) {
   7872 		(void) esp_ustart(esp, NEXTSLOT(slot, esp->e_dslot), NEW_CMD);
   7873 	}
   7874 exit:
   7875 	TRACE_0(TR_FAC_SCSI, TR_ESP_RUNPOLL_END, "esp_runpoll_end");
   7876 	return;
   7877 
   7878 bad:
   7879 	esplog(esp, CE_WARN, "Polled cmd failed");
   7880 #ifdef ESPDEBUG
   7881 	esp_printstate(esp, "esp_runpoll: polled cmd failed");
   7882 #endif /* ESPDEBUG */
   7883 
   7884 cleanup:
   7885 	esp_check_in_transport(esp, NULL);
   7886 
   7887 	esp_set_all_lun_throttles(esp, slot, CLEAR_THROTTLE);
   7888 
   7889 	/*
   7890 	 * clean up all traces of this sp because esp_runpoll will return
   7891 	 * before esp_reset_recovery() cleans up
   7892 	 */
   7893 	if (esp->e_slots[slot] == sp) {
   7894 		esp->e_slots[slot] = NULL;
   7895 	}
   7896 	esp_remove_tagged_cmd(esp, sp, slot, NEW_TIMEOUT);
   7897 	esp_decrement_ncmds(esp, sp);
   7898 
   7899 	if (sp->cmd_pkt.pkt_reason == CMD_CMPLT) {
   7900 		sp->cmd_pkt.pkt_reason = CMD_TRAN_ERR;
   7901 	}
   7902 	if ((sp->cmd_flags & CFLAG_CMDPROXY) == 0) {
   7903 		(void) esp_abort_allcmds(esp);
   7904 	}
   7905 	goto exit;
   7906 }
   7907 
   7908 /*
   7909  * Interrupt Service Section:
   7910  * Poll for command completion (i.e., no interrupts)
   7911  * limit is in usec (and will not be very accurate)
   7912  */
   7913 static int
   7914 esp_dopoll(struct esp *esp, int limit)
   7915 {
   7916 	int i, n;
   7917 
   7918 	/*
   7919 	 * timeout is not very accurate since we don't know how
   7920 	 * long the poll takes
   7921 	 * also if the packet gets started fairly late, we may
   7922 	 * timeout prematurely
   7923 	 * esp_dopoll always returns if e_state transitions to STATE_FREE
   7924 	 */
   7925 	TRACE_0(TR_FAC_SCSI, TR_ESP_DOPOLL_START, "esp_dopoll_start");
   7926 
   7927 	if (limit == 0) {
   7928 		limit = POLL_TIMEOUT;
   7929 	}
   7930 
   7931 	for (n = i = 0; i < limit; i += 100) {
   7932 		if (INTPENDING(esp)) {
   7933 			esp->e_polled_intr = 1;
   7934 			n++;
   7935 			espsvc(esp);
   7936 			if (esp->e_state == STATE_FREE)
   7937 				break;
   7938 		}
   7939 		drv_usecwait(100);
   7940 	}
   7941 
   7942 	if (i >= limit && esp->e_state != STATE_FREE) {
   7943 		esp_printstate(esp, "polled command timeout");
   7944 		n = -1;
   7945 	}
   7946 	TRACE_1(TR_FAC_SCSI, TR_ESP_DOPOLL_END, "esp_dopoll_end: rval %x", n);
   7947 	return (n);
   7948 }
   7949 
   7950 static void
   7951 esp_makeproxy_cmd(struct esp_cmd *sp, struct scsi_address *ap, int nmsgs, ...)
   7952 {
   7953 	va_list vap;
   7954 	int i;
   7955 
   7956 	ASSERT(nmsgs <= (CDB_GROUP5 - CDB_GROUP0 - 3));
   7957 	bzero(sp, ESP_CMD_SIZE);
   7958 	sp->cmd_pkt.pkt_address = *ap;
   7959 	sp->cmd_pkt.pkt_flags = FLAG_NOINTR|FLAG_NOPARITY;
   7960 	sp->cmd_pkt.pkt_scbp = (opaque_t)&sp->cmd_scb[0];
   7961 	sp->cmd_pkt.pkt_cdbp = (opaque_t)&sp->cmd_cdb[0];
   7962 	sp->cmd_flags = CFLAG_CMDPROXY;
   7963 	sp->cmd_cdb[ESP_PROXY_TYPE] = ESP_PROXY_SNDMSG;
   7964 	sp->cmd_cdb[ESP_PROXY_RESULT] = FALSE;
   7965 	sp->cmd_cdb[ESP_PROXY_DATA] = (char)nmsgs;
   7966 	va_start(vap, nmsgs);
   7967 	for (i = 0; i < nmsgs; i++) {
   7968 		sp->cmd_cdb[ESP_PROXY_DATA + 1 + i] = (uchar_t)va_arg(vap, int);
   7969 	}
   7970 	va_end(vap);
   7971 }
   7972 
   7973 static int
   7974 esp_do_proxy_cmd(struct esp *esp, struct esp_cmd *sp,
   7975     struct scsi_address *ap, int slot, char *what)
   7976 {
   7977 	IPRINTF3("Sending proxy %s message to %d.%d\n", what,
   7978 	    ap->a_target, ap->a_lun);
   7979 	if (_esp_start(esp, sp, TRAN_BUSY_OK) == TRAN_ACCEPT &&
   7980 	    sp->cmd_pkt.pkt_reason == CMD_CMPLT &&
   7981 	    sp->cmd_cdb[ESP_PROXY_RESULT] == TRUE) {
   7982 		IPRINTF3("Proxy %s succeeded for %d.%d\n", what,
   7983 		    ap->a_target, ap->a_lun);
   7984 		return (TRUE);
   7985 	} else {
   7986 		IPRINTF5(
   7987 		"Proxy %s failed for %d.%d, result=%x, reason=%x\n", what,
   7988 		    ap->a_target, ap->a_lun, sp->cmd_cdb[ESP_PROXY_RESULT],
   7989 		    sp->cmd_pkt.pkt_reason);
   7990 		if (esp->e_slots[slot] == sp) {
   7991 			esp->e_slots[slot] = 0;
   7992 		}
   7993 		return (FALSE);
   7994 	}
   7995 }
   7996 
   7997 static void
   7998 esp_make_sdtr(struct esp *esp, int msgout_offset, int period, int offset)
   7999 {
   8000 	uchar_t *p = esp->e_cur_msgout + msgout_offset;
   8001 	*p++ = (uchar_t)MSG_EXTENDED;
   8002 	*p++ = (uchar_t)3;
   8003 	*p++ = (uchar_t)MSG_SYNCHRONOUS;
   8004 	*p++ = (uchar_t)period;
   8005 	*p++ = (uchar_t)offset;
   8006 	esp->e_omsglen = 5 + msgout_offset;
   8007 	IPRINTF2("esp_make_sdtr: period = %x, offset = %x\n", period, offset);
   8008 }
   8009 
   8010 /*
   8011  * Command watchdog routines
   8012  */
   8013 /*ARGSUSED*/
   8014 static void
   8015 esp_watch(void *arg)
   8016 {
   8017 	struct esp *esp;
   8018 	int	i;
   8019 	ushort_t	props_update = 0;
   8020 
   8021 	TRACE_0(TR_FAC_SCSI, TR_ESP_WATCH_START, "esp_watch_start");
   8022 
   8023 #ifdef ESP_PERF
   8024 	esp_sample_time += esp_scsi_watchdog_tick;
   8025 
   8026 	if (esp_request_count >= 20000) {
   8027 		cmn_err(CE_CONT,
   8028 	    "%d reqs/sec (ticks=%d, intrs=%d, reqs=%d, n_cmds=%d, n_disc=%d)\n",
   8029 		    esp_request_count/esp_sample_time, esp_sample_time,
   8030 		    esp_intr_count, esp_request_count,
   8031 		    (esp_ncmds * esp_scsi_watchdog_tick)/esp_sample_time,
   8032 		    (esp_ndisc * esp_scsi_watchdog_tick)/esp_sample_time);
   8033 
   8034 		for (i = 0; i < MAX_ESPS; i++) {
   8035 			if (esp_ncmds_per_esp[i] == 0) {
   8036 				continue;
   8037 			}
   8038 			cmn_err(CE_CONT,
   8039 			"esp%d: ncmds = %d\n", i, esp_ncmds_per_esp[i]);
   8040 			esp_ncmds_per_esp[i] = 0;
   8041 		}
   8042 
   8043 		esp_request_count = esp_sample_time = esp_intr_count =
   8044 		    esp_ncmds = esp_ndisc = 0;
   8045 	}
   8046 #endif
   8047 
   8048 	if (esp_watchdog_running == 0) {
   8049 		esp_watchdog_running++;
   8050 	}
   8051 
   8052 	rw_enter(&esp_global_rwlock, RW_READER);
   8053 
   8054 	for (esp = esp_softc; esp != (struct esp *)NULL; esp = esp->e_next) {
   8055 
   8056 		mutex_enter(ESP_MUTEX);
   8057 		EPRINTF2("ncmds=%x, ndisc=%x\n", esp->e_ncmds, esp->e_ndisc);
   8058 		if (esp->e_ncmds) {
   8059 			esp_watchsubr(esp);
   8060 
   8061 			/*
   8062 			 * reset throttle. the throttle may have been
   8063 			 * too low if queue full was caused by
   8064 			 * another initiator
   8065 			 * Only reset throttle if no cmd active in e_slots
   8066 			 */
   8067 #ifdef ESP_TEST_UNTAGGED
   8068 			if (esp_enable_untagged) {
   8069 				esp_test_untagged++;
   8070 			}
   8071 #endif
   8072 			for (i = 0; i < N_SLOTS; i++) {
   8073 				if ((esp->e_throttle[i] > 0) &&
   8074 				    (esp->e_slots[i] == NULL)) {
   8075 					esp->e_throttle[i] = CLEAR_THROTTLE;
   8076 				}
   8077 			}
   8078 		}
   8079 
   8080 #ifdef ESP_PERF
   8081 		esp_ncmds += esp->e_ncmds;
   8082 		esp_ndisc += esp->e_ndisc;
   8083 #endif
   8084 		if (esp->e_props_update) {
   8085 			int i;
   8086 			/*
   8087 			 * e_mutex will be released and reentered in
   8088 			 * esp_props_update().
   8089 			 * Hence we save the esp->e_props_update now and
   8090 			 * set to 0 indicating that property has been
   8091 			 * updated. This will avoid a race condition with
   8092 			 * any thread that runs in interrupt context that
   8093 			 * attempts to set the e_props_update to non-zero value
   8094 			 */
   8095 			props_update = esp->e_props_update;
   8096 			esp->e_props_update = 0;
   8097 			for (i = 0; i < NTARGETS; i++) {
   8098 				if (props_update & (1<<i)) {
   8099 					esp_update_props(esp, i);
   8100 				}
   8101 			}
   8102 		}
   8103 
   8104 		ESP_CHECK_STARTQ_AND_ESP_MUTEX_EXIT(esp);
   8105 		ESP_WAKEUP_CALLBACK_THREAD(esp);
   8106 	}
   8107 	rw_exit(&esp_global_rwlock);
   8108 
   8109 again:
   8110 	mutex_enter(&esp_global_mutex);
   8111 	if (esp_timeout_initted && esp_timeout_id) {
   8112 		esp_timeout_id = timeout(esp_watch, NULL, esp_tick);
   8113 	}
   8114 	mutex_exit(&esp_global_mutex);
   8115 	TRACE_0(TR_FAC_SCSI, TR_ESP_WATCH_END, "esp_watch_end");
   8116 }
   8117 
   8118 static void
   8119